{
  "Event": {
    "analysis": "0",
    "date": "2025-11-18",
    "extends_uuid": "",
    "info": "XCTDH Crypto Heist Part 3 - Yashraj Solanki",
    "publish_timestamp": "1763468188",
    "published": true,
    "threat_level_id": "4",
    "timestamp": "1763467869",
    "uuid": "fbf8c6e8-5e74-493f-9699-ec352bcc179c",
    "Orgc": {
      "name": "Ransom-ISAC",
      "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"
    },
    "Tag": [
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#302c04",
        "local": false,
        "name": "DPRK",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:country=\"north korea\"",
        "relationship_type": "attributed-to"
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#0087e8",
        "local": false,
        "name": "osint:certainty=\"50\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "065f0731-a053-475c-97f6-b533084ac3be",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "337ea2dc-ccd9-4343-8e8a-a16d00a55a57",
            "value": "23.26.237.237"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "d6fe97d1-e98d-4c93-b779-f7b890aace66",
            "value": "2025-11-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "35cfbd14-fdf2-4749-a1ed-815c8f7ece4f",
            "value": "Rhadamanthys Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "775fcdac-22a0-401b-ad1d-fe35d19c4ed7",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "fa8317a3-0b35-4730-82ca-3b37d8d4c6d9",
            "value": "23.26.237.117"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "aaafdbf8-9dbd-4b1a-8786-f74c41f7c698",
            "value": "2025-10-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "0cf995e7-23c8-4153-9267-a0ae18d7c83a",
            "value": "Rhadamanthys Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "23ac0bfb-6be9-4a85-acd2-983cd31deac2",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "ef8fd29c-3e81-41c5-b726-d92683fb6afc",
            "value": "23.27.24.90"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "d93f04fd-1322-4c25-9cc6-86e68118d756",
            "value": "2025-10-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "3483c61d-1380-4368-bd87-6f612cbbe152",
            "value": "Sliver C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "842b00a8-8d2e-4804-9386-d978098a2719",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "1fcb399b-c8d1-43a6-a466-868b3dac37a1",
            "value": "23.27.168.222"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a10ab18b-3055-40d1-b9e6-9c44d97018e4",
            "value": "2025-10-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "a52ae1ef-3a4e-41d5-af4b-64035fc5c055",
            "value": "Rhadamanthys Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "50a147e8-0b63-42c4-ab46-4175f28d8452",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "c67b78bc-4c69-4027-92f8-c1f245a87d6f",
            "value": "136.0.141.91"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "28ea9d97-e1b4-4fa0-baad-26a35239fe74",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "541837c9-9c1a-4d76-8f3f-e58da012a01e",
            "value": "Rhadamanthys Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "5668f9b3-d2d9-4106-aa7d-5618c4641707",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "58a73baf-bb4c-4238-848c-29360476c310",
            "value": "136.0.141.245"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "e1d2d9ea-1870-4eff-bf84-ffbf63846c23",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "96e53fd4-d12f-4630-ae43-2962a31df530",
            "value": "Rhadamanthys Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "9278bf8f-4afe-43cf-855c-d5397572b7b6",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "c895feba-5eb2-4769-a522-906dbd3ae442",
            "value": "166.88.117.240"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a676b905-7435-44af-8f65-1d0708592d79",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "2f122552-24ca-4711-8740-6f5be21ce9e0",
            "value": "Remcos"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "8ff7cf27-8056-4944-be20-1fb3ec358b8f",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "1c8e9bb7-7d61-4253-b736-17ff52b61c3c",
            "value": "23.27.124.91"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "f62368d1-b3cd-48f6-905b-216f02dabd50",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "5a6bf56e-a34b-407d-a008-6fb7543fac11",
            "value": "Remcos"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "24dc4b86-ef83-4d93-b3ee-98ced5a27f2c",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "06fa6878-e35d-41c6-bf17-7420fff06626",
            "value": "156.227.0.60"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "7bc84771-b953-4fe8-a704-35aec0bce86c",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "90bc8770-e019-4292-854b-5d7460cbfb28",
            "value": "Rhadamanthys Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "12fe0f8e-0f84-4c3d-8933-da3cdfb8e229",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "c06a69d5-7cba-4677-9281-0f2ba42d91c3",
            "value": "96.126.191.167"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5136dc26-7be2-450a-b161-00dbaccbe99f",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "044eca3c-8da5-40a9-a541-8ace432a1e88",
            "value": "Xworm"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "96367804-bbc9-4bfa-88fe-7cf5a6635c74",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "089c9840-e770-44ac-af6a-3b46212c96f7",
            "value": "108.165.147.181"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "3cc4ff2d-10fb-4d98-8a06-f06e2bc4dc22",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "8b72bfa5-b8e0-4539-959a-00e2175871ef",
            "value": "SuperShell C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "bc42d52d-5f47-438c-83b5-2469d88d71be",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "0c707046-dea5-4e67-bb30-7ffa340e0f98",
            "value": "216.173.65.45"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5637fe90-6179-411a-9f96-6cfbb92e12c9",
            "value": "2025-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "d8a09691-4d29-43b0-8d6c-82f8637b993f",
            "value": "Remcos"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "41aae1a8-7818-40a7-a4e3-d2adec5512d3",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "6099e677-4b49-4dcd-a5d2-3a40956cdf61",
            "value": "166.88.194.123"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "940bf7ee-300e-4bb9-9898-b4d4b21563ab",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "dcb843bc-8702-4b54-8e20-3b42ea0e378a",
            "value": "Cobalt Strike (Watermark: 0)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "2af4dac4-7a5e-49ab-af5a-f6cbc6556d9a",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "39b7a0d2-db98-46a7-abfc-703ba010df6b",
            "value": "23.27.163.245"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "fdabbcac-92c4-49b7-a5e0-bac927d518da",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "52da1204-0b4e-42e8-a4e2-2544084aae50",
            "value": "VenomRAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "a95d4cdd-b514-46dd-a5b4-e47a380effe2",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "cb46afd1-ca2c-4a99-a278-3b6cc3ec3b6e",
            "value": "23.27.169.64"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "c87a1039-6ce7-4c16-885b-2d6a7b0b4741",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "ea8ddc75-f7f7-4e2c-b1c1-31d7aa8d0a3d",
            "value": "DCRAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "aa2abae2-2ea9-4a72-9247-579ceed4c8df",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "3ed003f3-3df8-45dd-a1d8-00cd0cfc2a12",
            "value": "23.27.24.227"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "3343dccb-ac03-4edf-ad00-d8e21985b63a",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "ebe2fdb2-9ff8-4dfc-b11c-a70af99da9b9",
            "value": "GoPhish"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "5e559632-b6c7-40d5-87de-246cb9f71762",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "af133be8-ed4e-4e03-af4a-570421a3d1eb",
            "value": "166.88.132.69"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "469b5ae4-c3b0-451e-a9e0-277f1c42c25c",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "bbcddf55-1a66-4834-9506-6133edc15662",
            "value": "Remcos"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "3ecd3c65-9678-40a9-afd2-1fb753f82548",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "ea330487-c82f-4861-b37d-9544b083ac09",
            "value": "166.0.132.184"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "0bc15ac2-938f-48d6-9224-0a2332a9a0ae",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "bf344c44-c759-40a2-a2ec-acb8b3eea3e4",
            "value": "Sliver C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "3cf6a51c-2b30-4e0a-90d4-fb126c8f676e",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "7842be52-0d44-4266-9998-ff330eb24bed",
            "value": "38.211.230.55"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "bc4377b3-195b-48eb-97ed-aad74092f4f3",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "c116f770-38cb-48b0-9c29-aa28552bf665",
            "value": "Remcos"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "f9cfc5d9-337a-4445-b987-50deec3227c8",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "670e7e81-0f4c-4fef-8d1e-9985dd7dc90e",
            "value": "23.27.201.30"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5a329960-a2e2-434a-9f51-9ed2cd502c88",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "a61734c7-b41b-40eb-8693-be46d40c8924",
            "value": "Sliver C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "c2e874a7-c916-4833-9eda-1467b649c8ae",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "7ed038c3-66e6-4485-a50f-6bedaf83e8b6",
            "value": "166.88.61.58"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "baec0e7c-ad02-4326-8d3e-6b2cfd3d6440",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "06ac3843-f379-4e42-9b26-e89f1cf6d9d0",
            "value": "AdaptixC2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "b16feb30-7b05-4108-b708-41f7241b36a8",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "eae31561-ff3d-4419-98a3-18f741374d6f",
            "value": "166.88.114.78"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "6c724fa3-f7f7-4838-8414-737111d9f9fc",
            "value": "2025-05-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "d045dd6a-e019-4c71-b731-61f5070359ac",
            "value": "Sliver C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "bdc4ddd2-50fd-4570-9e9f-35db6e7e8426",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "49aebaef-6402-4efe-a3db-5391f2bcee7a",
            "value": "166.88.100.85"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "37ebeeae-2df7-491a-8e0f-b3e14f1f3bfc",
            "value": "2025-05-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "1f2bbf28-59ce-4a81-be13-e6b5b279e484",
            "value": "Cobalt Strike (Watermark: 391144938)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "23ccdbf0-1d5a-4c90-b120-8e312399c398",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "878a47b4-6116-42a8-bdab-8622779f3a9f",
            "value": "23.27.48.77"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "1b502d2b-c56b-4754-a3a2-191a87d5a26d",
            "value": "2025-05-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "24e87fe3-ad4a-499e-ac60-e37bc6e6ec8d",
            "value": "Remcos"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "ef19e686-0a74-4f5f-a0f5-bfc24bdddbe0",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "c93ff879-457a-40df-a5ac-91e6b4226e21",
            "value": "166.88.95.137"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "9d36cb96-b79b-4d90-8a23-f3cc3afa1dc3",
            "value": "2025-05-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "68c00c2c-6a28-43c3-9da8-bd5b1e5169b8",
            "value": "Mythic C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "fde2ed79-667b-4eae-87b3-647482416b7c",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "5009e17b-5631-4108-aaa5-5ff15c043ea8",
            "value": "23.27.48.113"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "3ae867ba-e267-412d-a8c9-9c456fd58a5a",
            "value": "2025-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "76b7ee41-9c83-4397-9a21-ce0f7ec57491",
            "value": "Red Guard (C2 Redirector)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "90b0b6a3-6af0-4cc0-a1a7-aa389bf6ebdc",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "237fadc5-c94e-4ce7-97c7-5dcc17c328ba",
            "value": "166.88.14.137"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "b7a1ad2b-3f2b-4c56-9ca3-90691a76ee95",
            "value": "2025-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "4234f5b4-10e0-4127-8aae-8fe916f6270d",
            "value": "Cobalt Strike (Watermark: 391144938)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462360",
        "uuid": "b51067b6-c4a4-42e3-aaad-107e0e228d6c",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462360",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "16077b0d-6584-4b5e-bcc2-2c7f273faf65",
            "value": "216.173.64.63"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "datetime",
            "uuid": "414cd000-4a67-461f-ac5e-28588ea0942e",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462360",
            "to_ids": false,
            "type": "text",
            "uuid": "342be329-2152-472a-9a24-67aa1bece636",
            "value": "XWorm"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "17edc8b7-e411-4aea-87bc-7ad94e365322",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "dbba6ada-66ec-4a7c-ada4-9e2581a7e669",
            "value": "166.88.90.22"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "4bc7216c-2639-405d-b1e2-8921e36f7bd2",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "2b4ce429-d4bf-4552-b3bb-32760b02a6b6",
            "value": "AsyncRAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "19cff402-8b5d-419c-9c54-2c97371a6566",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "71f259a7-de76-40f7-8370-f681f4f544f6",
            "value": "23.27.169.4"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "e7a2f1f4-f39c-4323-8e56-3ccfbf362641",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "70028f21-8d1f-4ac6-b5cb-4fedfd8f69dc",
            "value": "Viper C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "c34f55ae-7455-42b1-aead-30f8d40c5028",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "138da6ef-d283-43c8-950f-47443f2b46b3",
            "value": "166.88.98.221"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "10ff1f42-3af2-43fe-a200-1036d94faeb9",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "5dfdb24c-0982-469f-9946-463a6cfd0cde",
            "value": "Cobalt Strike (Watermark: 0)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "eb488f94-43dd-4dab-9b0f-e8401b922b16",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "07043118-1286-4471-9860-99574cbba08f",
            "value": "23.27.240.252"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "262dd983-b88f-4dcb-85fc-f575dca798f3",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "aa12d4ce-62e3-4d0f-9c8f-800217ad6e12",
            "value": "Cobalt Strike (Watermark: 666666666)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "648c2c77-7fcd-4c63-8545-93cc711b3f0d",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "03f89fd8-c439-4602-8b48-45b064d69463",
            "value": "23.27.48.179"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "b2a477ac-a8ec-432a-88b2-dac9201c4f51",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "ab35ed8f-9c5c-4d2c-933e-4eb8d56a0385",
            "value": "Cobalt Strike (Watermark: 666666666)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "bcedee68-2241-4125-8b5c-214e49f3c9a2",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "8097172f-be66-44c3-91b9-b556e7cf6695",
            "value": "166.88.141.40"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a3ebf55c-17f0-4669-a92f-9607f89f3a9c",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "5d7d96e5-575f-4a46-83f9-69d945a9d490",
            "value": "Cobalt Strike (Watermark: 666666666)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "914cfeb4-d716-493c-92f3-6cbfb640ba55",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "08ce561f-117c-43a7-96fd-55d5fa028178",
            "value": "23.27.48.4"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "751d1d81-1f9d-4cc8-9837-62621972afa1",
            "value": "2025-01-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "8d7d7626-0d32-42bf-9008-d2b62f0f3205",
            "value": "Cobalt Strike (Watermark: 987654321)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "560d2bb9-ec5d-410d-8055-7d85abcc6a9b",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "49faad70-ef34-4298-83a3-1403f2543414",
            "value": "23.27.12.214"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "7efe2052-b94e-4985-878b-8fa3962ef4bb",
            "value": "2024-12-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "bc5459de-c25f-4613-9705-f67ee68ccdbb",
            "value": "SuperShell C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "ecad8843-7ffd-4651-a428-50e71f38dc36",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "20f74717-7297-4ccd-b680-c2a4124d263c",
            "value": "23.27.201.57"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "71208978-2c04-476d-950a-aef874e412e7",
            "value": "2024-12-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "2eaf99fc-24ed-4e37-8c88-0771c50245c2",
            "value": "UNAM C2 Panel"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "c2bc1ab9-8f3d-4765-a46f-9da4ebe4f2d4",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "be8cf94c-c159-4b96-b12b-40c6a51ec73f",
            "value": "156.235.89.227"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "af988812-d53c-414a-8fc2-9d9421a3ba38",
            "value": "2024-12-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "c1d7f111-8c90-4543-ae1f-1d530f07cd81",
            "value": "Sliver C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "b025c78a-c8c0-4fcb-b7a7-88f3763615ca",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "22d370f8-3049-4ae0-97b2-394936e61b09",
            "value": "23.27.240.237"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "8e2cd364-931f-4afa-b1ed-4b7fb77076ee",
            "value": "2024-12-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "6601276f-3980-4056-b822-bca546d117b0",
            "value": "Cobalt Strike"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "816dc899-cf45-4bc0-9bef-7048229fc8de",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "f8a8d836-2ee7-4c02-ab78-9ede6998c161",
            "value": "45.194.27.99"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "5337acb2-6f77-44d3-8026-f753aa840446",
            "value": "2024-10-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "d87c7ad2-9a6d-4f82-88a2-158716371450",
            "value": "Sliver C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "df5d45f9-e368-4578-a709-1b0bd8455998",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "4782f79d-215b-4cd5-93e7-3bf1620c4ef9",
            "value": "166.88.57.117"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "ea5135d2-9aa2-4e38-b242-636d78d504d9",
            "value": "2024-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "f7ff31e2-c0b7-48a9-a1ca-152a8b4cb206",
            "value": "SuperShell C2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "6556a903-91ea-48ef-98c7-58052ddcb820",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "77ed5f6b-c45d-48ba-9bda-9745da95922c",
            "value": "136.0.11.193"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "27d69153-8d60-4367-bd1d-04fe872f9797",
            "value": "2024-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "2db2faf4-b79e-4fc8-aa4a-3a32b32f4b7d",
            "value": "Cobalt Strike (Watermark: 100000)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "c678428d-3771-499d-9c8f-da561a1be572",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "28ef1939-2f23-4b8a-8275-b1e065a90d90",
            "value": "23.27.244.39"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "531efbb1-3d76-46d9-9426-d83e858ac793",
            "value": "2024-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "dc035f11-22f6-4ed1-aae9-2eee2a250698",
            "value": "Remcos"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "6922d01d-f4eb-4c7f-b48c-969702bf7547",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "5c80f840-ce2e-4574-a46b-ff012c9723a7",
            "value": "172.121.5.230"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "d32e6404-0451-4c30-95d8-b3d41da89d77",
            "value": "2024-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "868dc500-7aaa-4a9d-8598-bcd91773f3cc",
            "value": "Cobalt Strike (Watermark: 100000)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "6a7388c5-eda4-472b-91c8-46aebbb9c712",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "0af14505-88b1-44d1-887a-a711fbfb757c",
            "value": "166.88.132.139"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a9255773-a9b9-4968-8ca1-3678d386bfea",
            "value": "2024-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "2f910f71-5b7a-4900-8918-68edc34206cd",
            "value": "QuasarRAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "f0ba7411-304a-4ead-8545-e7deeee47de5",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "f49116ff-0450-4d53-914b-161043f1d2c4",
            "value": "166.88.97.138"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "eb8d895a-5669-4c97-8483-f7f754039bac",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "5740ca92-b8a0-4003-b67c-8f70174e08a7",
            "value": "PlugX"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "ef360114-fb92-4337-8b80-8977114aca5d",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "e31b725d-0027-4826-90cd-ae58baf155f5",
            "value": "166.88.61.35"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "9655e64f-fc30-46d2-975f-88116cbdf316",
            "value": "2025-07-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "d8f707f9-6e12-414c-be37-edf0c39d36f6",
            "value": "China Aligned Espionage - Cobalt Strike (Watermark: 100000)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "ec3af9b8-478b-419e-ad2d-f92b943bc7de",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "d00308ae-5416-43ba-8c33-64362424bcef",
            "value": "166.88.96.120"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "7dfd35db-183b-4541-8ace-5b1f0dfd5d6c",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "681696c9-b1fe-46f0-b301-0cf6b1b8bca2",
            "value": "Cobalt Strike (Watermark: 100000)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "db66e302-c7d8-46d0-b6f8-024886bfdb1b",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "ddf5adfc-e8bd-4538-ac80-16a44edf45b5",
            "value": "166.88.4.2"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a7800515-5068-4e66-8b04-8c3adbac2414",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "e52626ce-635e-4581-abd2-2cfed6a465c9",
            "value": "NPM Supply Chain"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "28380290-bf43-4726-b6e4-aacb0fcf45f6",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "9d66e055-4766-425c-b16f-acabd66c33f0",
            "value": "166.88.2.90"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "04c4225a-0600-45c1-b4d6-11196f3487c7",
            "value": "2025-08-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "27b16e58-3ecd-47c6-bf28-b04354472fcb",
            "value": "Dark Peony (Operation Controlplug)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "937f4706-19d5-4a54-866e-b355c7502d49",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "e22fe68e-8cd3-4443-b684-7bef883153d0",
            "value": "166.88.194.53"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "2172c1c0-4922-4916-93ca-eb22c2c212e4",
            "value": "2025-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "e16200fd-2440-4c0f-901a-536b3b6f9920",
            "value": "Earth Kurma"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "e3de6780-f07b-477b-89d5-54d0b855e05a",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "bcd5e1a6-96d9-4a11-80ab-9c39e481bfbf",
            "value": "166.88.61.53"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "4c7c5f72-4030-4744-85df-11cef9bcca01",
            "value": "2025-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "95ae71f9-cda6-454d-8eb9-49f13700fc26",
            "value": "Russian Infra with DPRK"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "45570fb7-ca5c-49fd-a21c-bd41349c96f8",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "49c20be7-b712-4680-905b-ab24796fac6e",
            "value": "166.88.117.11"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a4411c5e-060e-44ff-8ef4-109732582ce5",
            "value": "2025-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "b332f2fb-c14d-4c6d-aa12-f25c4c888bb0",
            "value": "Dark Peony (Operation Controlplug)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "5be4ff6f-eb8d-4568-9069-99fd13133ace",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "dfd96348-0e50-4edd-99aa-72548d795a2f",
            "value": "166.88.35.203"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a4a895ea-bd0b-4671-ab47-a1a505e14352",
            "value": "2025-03-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "008a9fc9-b439-4c44-bff9-e39e69418303",
            "value": "Dark Peony (Operation Controlplug)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "f2ce95ac-f3bb-47e0-a670-a1f0a0bdaf86",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "a00c85bd-6030-4cbf-8fe6-370e61b30097",
            "value": "166.88.2.184"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "01c38729-0d15-45eb-82da-036b52f7291a",
            "value": "2025-03-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "915d058f-a6ab-461c-a3e9-cd90ba390c8e",
            "value": "Cobalt Strike (Watermark: 666666666)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "ac7f4013-8972-4c8c-96b7-80aed99d0d8f",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "62aab192-090c-42ac-ba22-f30e9a5dbff1",
            "value": "166.88.14.52"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "c70d0f47-18d0-477e-8bf8-02e9eafc2e8a",
            "value": "2024-12-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "d6ba7fb6-6e11-43f2-8175-24cf142e178c",
            "value": "Cobalt Strike (Watermark: 987654321)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "cf226697-eea1-4c6b-8905-3f5738644bdb",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "16e8ee0b-0ab2-469a-991d-8bb5c0b08543",
            "value": "166.88.14.44"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "03ad2474-0a24-482d-bdbc-f57db9686551",
            "value": "2025-03-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "ebd8b7c2-97fd-45c6-a9e4-4bcd0c5e06bf",
            "value": "Xworm"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "07fdb3ee-1017-43cf-8905-abc0220db35e",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "401777ba-2336-4e5f-be9b-0beecd97d395",
            "value": "166.88.101.20"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "ff9682e7-db69-45c0-8563-b0cda286949d",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "ba263162-6294-4ea5-bfb7-48eea6583bcd",
            "value": "DeimosC2"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "93979144-9a8b-403f-9545-f717b3073613",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "f75dfd23-f07e-49bc-b70e-0aa6fdab0e43",
            "value": "166.88.99.15"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "88f84723-f9d9-4b6f-80fd-45bb9b8834fe",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "2ac717a8-b10a-4152-8e15-0e998ac231b3",
            "value": "Cobalt Strike (Watermark: Unknown)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "8be8e429-e623-43eb-b754-78d608faa17c",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "093067cb-fd90-4e5e-a2f2-681a96674403",
            "value": "166.88.55.54"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "9603ce18-1cce-449b-b1b1-28daf22b978f",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "58cd5f57-4307-431c-aaa7-e40a37f8a2c0",
            "value": "Cobalt Strike (Watermark: Unknown)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "99d58751-209a-4dbd-84ed-e67b6f207005",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "3e402baa-5d92-4d78-bb4c-e5ea67c0d5de",
            "value": "166.88.132.39"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "33574911-a7a0-4ac1-bfac-cc0e50314eee",
            "value": "2025-11-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "c6505c61-a483-46e7-aed9-c808f7047ab0",
            "value": "DPRK Lazarus - Contagious Interview"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "1e90eb7e-3f15-4fca-b673-5eeb19969ab3",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "7d9d6399-1a91-45a4-9d98-5a47ce1a6459",
            "value": "166.88.159.187"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "f3e5b099-956b-432f-839c-0dd8fa5d8635",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "7a45915d-1925-4680-962e-0e7aa22e7d8e",
            "value": "FIN7"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "8e589ddb-c6c9-4e11-bf05-d7ff5a8074b0",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "837c239f-64e1-43e9-91e1-017cd131ebeb",
            "value": "166.88.159.37"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "642bd52d-218d-4b89-b6ea-39e5989ec85b",
            "value": "2024-10-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "28702442-9795-46b3-b2b5-ea185e5bf946",
            "value": "FIN7"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "d48f832f-d6e4-4cc5-b59b-2f0e58078961",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "db404d6e-7a46-48bb-91cf-d9d2e04d97b5",
            "value": "193.57.57.121"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "ce4f8a85-c2e6-487f-8040-eab416cd6582",
            "value": "2025-01-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "0e4e314d-e457-407c-8dd2-4b2a4211ddb5",
            "value": "Cobalt Strike (Watermark: 100000)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "5c80d806-4eb9-4112-9bf6-9c374bbd4f9c",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "5a74799e-6cca-420a-9267-e931ead6809c",
            "value": "198.105.127.98"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "15e93c99-83d7-4227-a869-62a68fdb8f50",
            "value": "2024-05-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "dde6d87b-c41e-4120-b356-40bf1a7045c3",
            "value": "DPRK Lazarus (through domain resolution)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "aa3965ff-d223-4e10-8bf6-e24ffd452d45",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "b76cef9f-2e19-4535-9160-88f644f6df63",
            "value": "198.105.127.124"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "4bbbb342-2f28-4837-b4b8-290852be2041",
            "value": "2025-05-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "63aa9177-70ec-4354-bf7f-6e2e4487c284",
            "value": "PoC Exploit for Critical Zero Day"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "8cdcea79-1b6c-428b-a6fe-698e6229b111",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "706777f3-1271-44eb-aee4-19f1794adf6c",
            "value": "223.165.6.30"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "fbae0fb9-72a1-4fe6-8cdb-72f3068ad183",
            "value": "2024-07-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "a24d3a9c-87fc-493f-90e3-542a0f143148",
            "value": "VenomRAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "6fd2550d-462c-4e2e-991a-435065808179",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "dd2024a5-b498-4a07-914e-7cf394a2eba3",
            "value": "38.211.230.5"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "d723e1d5-35b5-4d76-8f42-791a9ee3d1c1",
            "value": "2025-07-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "1970457b-2951-44b1-9c31-977401d6d8e7",
            "value": "Dark Peony (Operation Controlplug)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "023d8ab9-511d-43a3-8947-42af4345969c",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "f368a5d1-da46-4556-b30c-6509eb05980e",
            "value": "38.246.73.120"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "88bcb507-6523-4f85-91da-5ed0ee42472b",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "aa446695-8b8f-4576-a955-fdf1b92f2ec3",
            "value": "Dark Peony (Operation Controlplug)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "a0df90b6-50a3-47c3-ba88-715910356991",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "f45a1ada-fa4e-46b3-8ee4-611aa90762de",
            "value": "45.195.76.82"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "fa9c902c-0e1b-44ec-b344-068a1cf14594",
            "value": "2024-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "2cf43eaa-d5b6-4ec4-9ed3-ffabfa7432bd",
            "value": "Cobalt Strike (Watermark: 100000)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "39112172-51d6-408a-a715-51e531cb6768",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "ebc5a4a6-b2df-48b7-a15b-99e49d668465",
            "value": "45.195.76.26"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "4ea49ef1-07f5-4b67-b86a-ca85a792afc0",
            "value": "2023-12-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "0471e05c-9e73-4b08-985b-d5d7646fe42a",
            "value": "ShadowPad"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "a73c92e6-b017-4e99-8b00-94a99f6daac1",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "d387409d-f540-44dc-985e-c45a44e5230c",
            "value": "50.114.5.82"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "884850bc-1fed-4722-8a40-47039bd08bc7",
            "value": "2024-09-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "445339e1-481f-4546-9b67-3958f7e9ccf9",
            "value": "Supershell"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "3a760260-c2c3-45a1-9434-8b419e2a4bba",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "ad78eb5e-be43-4688-ab49-f74abea11637",
            "value": "91.218.183.90"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "95a17dcd-3369-4197-8672-ad8f257055bb",
            "value": "2023-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "8632c964-e0c8-4c7a-9e85-52526fc9eb04",
            "value": "Cobalt Strike - Threat Actor: QUARTERRIG (APT29)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "a5383687-261c-457f-be8e-823ca5746919",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "151d9049-7480-4743-b1c5-7312417d045b",
            "value": "103.179.142.121"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a6e64635-4d51-44f8-b8ba-00e817ba44a6",
            "value": "2023-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "ed68e55c-469a-4f5b-9764-5fc4e9a9acfc",
            "value": "AveMaria"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "9e15c2d6-7051-4312-aab8-8d7eaf66b17d",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "63cc05e5-c110-41b6-b041-8f90793156ec",
            "value": "136.0.3.250"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "b96b619f-51cb-4f86-8316-a06e72ca0175",
            "value": "2025-01-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "224ec6ab-8c58-481c-8447-e58cb525c610",
            "value": "AsyncRAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "bf72319f-532c-41fe-8e4e-e2999eb80ad9",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "236388b9-828a-43a1-897b-9669be61ddb6",
            "value": "136.0.3.71"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "25bf0430-c310-4c82-9c0b-a5a1506895a0",
            "value": "2024-03-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "d3004070-0487-416f-b712-5686f8428313",
            "value": "Bianlian"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "6013cb99-8f4f-4762-bb44-168dfcc855ac",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "587d25ef-fe6a-4457-b7cc-c313f4c7c6af",
            "value": "136.0.3.240"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "c8b03a08-fa02-44c1-b017-e91853d3e948",
            "value": "2024-01-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "a05a601b-ed00-4973-a421-1f43a52bceb8",
            "value": "Bianlian"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "ecf2a065-1033-4d9d-8ae7-f4770181d9c5",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "74370cb1-bf19-43ef-99ea-51bd1d420d01",
            "value": "136.0.8.169"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "48932843-87bb-4b93-af91-25851bc7bd45",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "db178abb-d373-4f19-9026-28e7823c479b",
            "value": "Danabot"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "fb9f3779-eea1-4eec-bfa9-823051d925b9",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "0c44de2c-21c2-4eac-b08e-6ee2ca89c799",
            "value": "136.0.9.8"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "48d42446-8b44-4d7f-add1-be2eea438fbe",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "903f1953-45c9-40e8-8663-e56d61497b7c",
            "value": "NPM Supply Chain (Ports: 27017 and 3306)"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "ca7c9f0f-471b-408e-b75e-c7ab4db25c1e",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "edeb2e2c-488d-49c6-bb09-65364e55cf4e",
            "value": "142.111.77.196"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "6dfa1393-3167-4efb-9d17-be0d6106ba1b",
            "value": "2024-07-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "fe9d8d99-e548-4c2a-a290-e2286790d448",
            "value": "DPRK Moonsleet NPM"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "c4db41ba-05a2-4cce-8fe6-df5e5c5e3163",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "6b94db29-029b-4b7b-8f8d-fa69ab0bff50",
            "value": "154.81.220.233"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "23e0895b-ae1c-4804-b982-897d08ff7afe",
            "value": "2025-02-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "58dc0054-0f59-4cb8-9ea8-e15db669d6d2",
            "value": "Redline Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "e0673e76-a799-49a0-8659-25081f135ac6",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "59959bc3-2034-4314-bb7a-6f7998b7d068",
            "value": "155.254.60.160"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a4761925-90ea-4004-bbad-e650264bf2f0",
            "value": "2025-05-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "04320b9a-2586-4217-86fd-9260dfbbf898",
            "value": "ViciousTrap CVE exploitation"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "5cd5c9e2-16c3-4fa6-b153-44fb34c50ba9",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "61e11e5a-1f30-47d4-b06a-d5360f319653",
            "value": "156.227.0.187"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "0abde638-6c09-4800-b859-9205d0a2f18b",
            "value": "2024-04-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "9a23a3ba-34ea-46e4-a6e3-2301ee5cbd76",
            "value": "Agent Tesla Targeting Entities"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1763462361",
        "uuid": "ad870630-6de2-4853-a95d-0fc2a430c772",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1763462361",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "3d587c26-4861-4d2e-bb58-af7df85e02de",
            "value": "156.236.76.90"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "datetime",
            "uuid": "7216d47a-0f38-412c-b330-f34ada5bd687",
            "value": "2025-06-18T00:00:00+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763462361",
            "to_ids": false,
            "type": "text",
            "uuid": "6dbf1297-24a2-4659-8433-5b9fbd4796ed",
            "value": "PoC Exploit for Critical Zero Day"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463424",
        "uuid": "4dab8b58-387e-4d44-9296-a0f08df1cd4e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463424",
            "to_ids": true,
            "type": "sha256",
            "uuid": "40839075-dede-485c-b462-249856e5333d",
            "value": "742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463424",
            "to_ids": true,
            "type": "filename",
            "uuid": "53251a67-895c-4ea3-a513-fce280a0cabb",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463424",
            "to_ids": false,
            "type": "text",
            "uuid": "676fda40-743c-4b41-8181-389587d02c0d",
            "value": "DPRK APT - Python Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463425",
        "uuid": "640a8aa2-083b-4b35-ab7c-bd3e42813204",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "sha256",
            "uuid": "dfa76fd1-472b-4533-9f1d-299a5fa85b02",
            "value": "a7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "filename",
            "uuid": "f84a72bd-eade-44e4-8230-5221916c2220",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_1_1Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463425",
            "to_ids": false,
            "type": "text",
            "uuid": "ac222345-de52-4282-a33e-4b640c9cb509",
            "value": "DPRK APT - Python Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463425",
        "uuid": "2c2123e1-3ed2-4374-b061-57e1052aa85a",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6c831933-14c2-47e9-8d77-a41836d7e08c",
            "value": "236ff897dee7d21319482cd67815bd22391523e37e0452fa230813b30884a86f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "filename",
            "uuid": "3a9daaab-0504-4c03-ac28-f8fb7edfb56b",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463425",
            "to_ids": false,
            "type": "text",
            "uuid": "320d25cb-7cbb-4ac4-b776-8421ba0646f8",
            "value": "DPRK APT - Python Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463425",
        "uuid": "5eeaa68b-fb2f-4a97-a714-85e02b00da16",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "sha256",
            "uuid": "58f178d8-04cb-4f7b-a293-faa96cd1cfd1",
            "value": "742016f01fa89be4d43916d5d2349c8d86dc89f096302501ec22b5c239685a20"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "filename",
            "uuid": "be15b181-a9df-47d0-973c-e6127400e8a0",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463425",
            "to_ids": false,
            "type": "text",
            "uuid": "c88f5467-e224-4739-a602-f027baaadbd8",
            "value": "DPRK APT - Python Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463425",
        "uuid": "46fcf0b4-8451-45c1-ac82-a807ab4349ce",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a7e9b2db-2b76-4d98-aae6-8f4d683a2ffb",
            "value": "a7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "filename",
            "uuid": "e1d53ca5-9ac7-470e-8409-69cc21088cbc",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463425",
            "to_ids": false,
            "type": "text",
            "uuid": "a364373a-c414-4446-b673-8ead79b89193",
            "value": "DPRK APT - Python Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463425",
        "uuid": "5ca0d305-f709-4258-b82d-85729208056d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "sha256",
            "uuid": "e6444cc5-2303-4075-b8d2-8e69e40803ac",
            "value": "24cad593f02db847d1302ee7c486d0756708521d5ae69faa9d6600dff81fd924"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463425",
            "to_ids": true,
            "type": "filename",
            "uuid": "32486bab-747b-4443-9b69-b306a7fe719d",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463425",
            "to_ids": false,
            "type": "text",
            "uuid": "274d958b-da09-4c8d-92a3-93444a58c162",
            "value": "DPRK APT - Python Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463426",
        "uuid": "40d1e942-b98d-487e-ae2b-91e2eddde9c0",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "sha256",
            "uuid": "a5b81a1f-29ba-4c02-aee9-d90aa1bc670f",
            "value": "a51c2b2c5134d8079f11a22bd0621d29b10e16aefa4174b516e00fa40dafde69"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "filename",
            "uuid": "d32c6f43-0679-47ff-a991-7720b7e4ba31",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_PY_Stealer_Unknown_Strings_2_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463426",
            "to_ids": false,
            "type": "text",
            "uuid": "4260025c-9477-4b94-9f1a-e40bd46034f3",
            "value": "DPRK APT - Python Stealer"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463426",
        "uuid": "d1f058ce-fdaa-405e-924c-91eb34e22da1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b553292b-f7bd-4837-864f-1f0e1e419f1d",
            "value": "be21bf4ad94c394202e7b52a1b461ed868200f0f03b3c8544984e9765c23e1e0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "filename",
            "uuid": "74b82abb-6c7f-40f1-aecf-ddaaffa5d32b",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463426",
            "to_ids": false,
            "type": "text",
            "uuid": "2330b91b-c697-48f1-8ef3-008837596fd9",
            "value": "DPRK APT - JavaScript Loader"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463426",
        "uuid": "82099be2-784a-448b-90bc-c63461824e1d",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6bbb06e7-94eb-4f32-83d3-b382c591b455",
            "value": "87330f64f5cd4695f2385f87c9ffffee26d5ad2637665f1cd5d7fce217770a4d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "filename",
            "uuid": "19f7dd2e-9990-45db-9f53-d987828b7f25",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463426",
            "to_ids": false,
            "type": "text",
            "uuid": "ee013b07-cf16-4d28-a143-119b2c963c2a",
            "value": "DPRK APT - JavaScript Loader"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463426",
        "uuid": "fe57ce5b-f3cb-4a36-8000-45dac5ba46bd",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5b4cf112-a90f-4d60-b6c2-fad21d35c1e5",
            "value": "ba738d8fa5ecd4b996612dde6cd4516cbe7116305661521ffcfd62d37687875d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "filename",
            "uuid": "1d79d6dd-2bfb-49e6-8677-97efddf50acd",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463426",
            "to_ids": false,
            "type": "text",
            "uuid": "62142a14-50a1-4e29-84c5-aa47c4b4439d",
            "value": "DPRK APT - JavaScript Loader"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463426",
        "uuid": "987b6f38-5cb8-4b8f-a269-44a476599922",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "sha256",
            "uuid": "927587cf-f827-4e71-bb68-2092f7f6ce96",
            "value": "83a84588a941e463c981083555a2e7814887fa8816e7cca5af9cb7fd0b62cdac"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "filename",
            "uuid": "709f9118-9f0f-4a76-9c4c-40132e3b42d4",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463426",
            "to_ids": false,
            "type": "text",
            "uuid": "f3b6382f-ff3a-4da5-be1d-ab1e29699ceb",
            "value": "DPRK APT - JavaScript Loader"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463426",
        "uuid": "cd8afeec-1651-4e35-a419-518eebd0da12",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "sha256",
            "uuid": "16f26fe9-942b-4bab-92b2-1517ce33a502",
            "value": "6e48fe09117ead1ef2c10a3db614217184fc300ac70ee902f67510b8d0d0b0c8"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463426",
            "to_ids": true,
            "type": "filename",
            "uuid": "c062fc0d-c15c-4988-b7c8-62b406a5f71a",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463426",
            "to_ids": false,
            "type": "text",
            "uuid": "5f23db6f-7c70-465a-9149-c47e423bc2d6",
            "value": "DPRK APT - JavaScript Loader"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463427",
        "uuid": "f02b6482-9390-4384-8e50-19e5eedb1fd9",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "sha256",
            "uuid": "1a1121d2-6202-4a99-875b-bf72d8e2960f",
            "value": "897d040e5db47b806c01eb2a1a056ca49b10e0aa4985f84d2b808a121083570e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "filename",
            "uuid": "eafcbf89-2935-4eee-a80e-cd6ef4a7e490",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_Loader_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463427",
            "to_ids": false,
            "type": "text",
            "uuid": "623fe0eb-b966-43a5-94a1-1a0a132063ff",
            "value": "DPRK APT - JavaScript Loader"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463427",
        "uuid": "73f85af6-ba4c-4f14-a3a6-35383b070e9e",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "sha256",
            "uuid": "5c350bdf-9631-4a40-b661-9b0f4e70ab09",
            "value": "eefe39fe88e75b37babb37c7379d1ec61b187a9677ee5d0c867d13ccb0e31e30"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "filename",
            "uuid": "0cd9954d-a6c0-41d9-b9d1-8abed6fc290f",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_RAT_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463427",
            "to_ids": false,
            "type": "text",
            "uuid": "05d53a57-643c-4f98-a380-ad067e8fd8c4",
            "value": "DPRK APT - JavaScript RAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463427",
        "uuid": "1198c10f-3378-42c6-b038-e328f25f13d1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c075413f-e712-4776-a34d-e15dcc46a65d",
            "value": "43dc7a343649a7ce748e4c2f94bcb6064199507cfd9f064a2d462536bec1d57f"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "filename",
            "uuid": "a143805c-f69b-46be-ac06-4a3e5e6e2dd8",
            "value": "Actor_APT_DPRK_Unknown_MAL_Script_JS_RAT_Unknown_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463427",
            "to_ids": false,
            "type": "text",
            "uuid": "5521c80c-0160-46e3-ac02-4c3ddd9c83f5",
            "value": "DPRK APT - JavaScript RAT"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463427",
        "uuid": "270d3cd3-692e-456f-9078-1e03f6aa3afb",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "sha256",
            "uuid": "cfccee77-574b-4c50-9f97-70fe0b6634f5",
            "value": "908696f3ec522e846575061e90747ddf29fccab0e59364597493d72159986c60"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "filename",
            "uuid": "c575edf1-2d00-4b6f-a93c-8d405c3da75d",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463427",
            "to_ids": false,
            "type": "text",
            "uuid": "e1cb274e-8bd3-4089-ae27-9805db436e44",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463427",
        "uuid": "832026a9-5c93-4683-80a8-68221750baca",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "sha256",
            "uuid": "b49aaf70-5d89-4e31-a31b-09776d4b1281",
            "value": "897d040e5db47b806c01eb2a1a056ca49b10e0aa4985f84d2b808a121083570e"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "filename",
            "uuid": "c848fb0a-fa80-4d82-80b8-a650941f42aa",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463427",
            "to_ids": false,
            "type": "text",
            "uuid": "e0672403-308e-406e-a82f-1ad1dcac0f94",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463427",
        "uuid": "5eaa8934-1501-4799-a3cc-573526e29efe",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c8c10b14-33c5-4e6c-b33f-659ee80897e6",
            "value": "be21bf4ad94c394202e7b52a1b461ed868200f0f03b3c8544984e9765c23e1e0"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463427",
            "to_ids": true,
            "type": "filename",
            "uuid": "ec0a1525-fc42-4049-8d14-6610eca303d8",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463427",
            "to_ids": false,
            "type": "text",
            "uuid": "518a29d6-4d61-44ae-b93e-fdefcd0dfdf9",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463428",
        "uuid": "51e3116a-5461-41c8-971a-94c88b577036",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7d7548d2-ad2c-4137-bb1b-62004b65ff43",
            "value": "6e48fe09117ead1ef2c10a3db614217184fc300ac70ee902f67510b8d0d0b0c8"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "filename",
            "uuid": "11086198-33eb-48b9-a9be-631ba3e4df24",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463428",
            "to_ids": false,
            "type": "text",
            "uuid": "61569a19-c3a5-414c-8220-763014d12536",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463428",
        "uuid": "235e8f19-9a16-4e38-8c81-958a37b49b73",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "sha256",
            "uuid": "6a47dcb3-7d83-4327-b7b7-e1fa26e25d92",
            "value": "87330f64f5cd4695f2385f87c9ffffee26d5ad2637665f1cd5d7fce217770a4d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "filename",
            "uuid": "680755fc-73c1-4a83-81cf-f4c394f032de",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463428",
            "to_ids": false,
            "type": "text",
            "uuid": "d53b441b-489f-4c1e-9f53-cb142a4cbae9",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463428",
        "uuid": "015692fc-35f0-43fe-86b6-975b48d94e1f",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "sha256",
            "uuid": "d401d956-7097-4c50-8a39-0a61a96a7e9d",
            "value": "83a84588a941e463c981083555a2e7814887fa8816e7cca5af9cb7fd0b62cdac"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "filename",
            "uuid": "0a938c20-1546-4351-adfd-6bb1938b3b22",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463428",
            "to_ids": false,
            "type": "text",
            "uuid": "73f4c658-4ffe-4189-b723-b18aeaa14712",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463428",
        "uuid": "9978cc68-452d-4681-85b9-5c65992c5ba2",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "sha256",
            "uuid": "655e64a9-8798-471c-ba7c-25c31e818fcd",
            "value": "ba738d8fa5ecd4b996612dde6cd4516cbe7116305661521ffcfd62d37687875d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "filename",
            "uuid": "e8f69ff4-229e-494e-91a8-3b2c201a0c5b",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463428",
            "to_ids": false,
            "type": "text",
            "uuid": "6b437886-9410-46b4-a408-fe91b92bbd50",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463428",
        "uuid": "b05b52f4-d742-48b3-a193-abe1b0af27c1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "sha256",
            "uuid": "0c7a5bfd-f9f9-4007-a7ea-91d13cf0f7de",
            "value": "a2880c2d262b4a76e64fd29a813f2446ecbd640f378714aa575bf1064b7adc29"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463428",
            "to_ids": true,
            "type": "filename",
            "uuid": "253240e0-876a-4425-81a2-fdccf2afc8ed",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463428",
            "to_ids": false,
            "type": "text",
            "uuid": "12284301-51ff-4e9a-8e11-139becd508ae",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463429",
        "uuid": "cb660d27-6c54-4c98-8458-a4b5c33fddd1",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463429",
            "to_ids": true,
            "type": "sha256",
            "uuid": "7d947f99-0680-4ae4-aebc-e27e773afd8c",
            "value": "973f777723d315e0bee0fb9e81e943bb3440be7d2de7bf582419ae47479bc15d"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463429",
            "to_ids": true,
            "type": "filename",
            "uuid": "472f1ba5-86b5-41e8-828b-6f702440b371",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463429",
            "to_ids": false,
            "type": "text",
            "uuid": "a96d7d74-6b52-4cfa-a87d-81f58f82fb30",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1763463429",
        "uuid": "a7704023-5377-4ecc-b770-fc0aa59247be",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1763463429",
            "to_ids": true,
            "type": "sha256",
            "uuid": "c8eed92b-6e83-4946-a96a-318c774c2bfb",
            "value": "a7d7075e866132b8e8eb87265f7b7fab0e9f6dd7f748445a18f37da2e989faa3"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1763463429",
            "to_ids": true,
            "type": "filename",
            "uuid": "232c595a-1252-4c44-9052-df22166551c9",
            "value": "Actor_APT_DPRK_Unknown_MAL_Indicators_Strings_Oct25"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1763463429",
            "to_ids": false,
            "type": "text",
            "uuid": "52325eb3-94e3-4c52-8acc-ef62325c34a4",
            "value": "DPRK APT - Malware Indicators"
          }
        ]
      },
      {
        "comment": "166.88.159.37: Enriched via the circl_passivedns module",
        "deleted": false,
        "description": "Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-07. See https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html",
        "first_seen": "2024-10-03T05:21:55+00:00",
        "last_seen": "2024-10-03T05:21:55+00:00",
        "meta-category": "network",
        "name": "passive-dns",
        "template_uuid": "b77b7b1c-66ab-4a41-8da4-83810f6d2d6c",
        "template_version": "5",
        "timestamp": "1763467808",
        "uuid": "6884465a-fb28-45c2-8dba-b4175a45b6cf",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "count",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "counter",
            "uuid": "d66624cc-32f8-44b0-bb86-a73b3e690bbf",
            "value": "1"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "origin",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "535d7a2b-05ae-4c68-bc16-eb06c3524560",
            "value": "https://www.circl.lu/pdns/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "rrtype",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "509db34c-803c-4e47-9859-6e3d86df5a4d",
            "value": "A"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "rrname",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "9ba4c4b4-8e51-486f-9b0f-5f2897c457d7",
            "value": "166.88.159.37"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "rdata",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "d0443b20-c37b-4cf6-bc29-4ae6690fd160",
            "value": "756984.xyz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "time_first",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "datetime",
            "uuid": "df268275-e768-4091-b056-54df6006e2ef",
            "value": "2024-10-03T05:21:55+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "time_last",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "datetime",
            "uuid": "852fd745-af5c-48ef-9e91-1d7b966385e7",
            "value": "2024-10-03T05:21:55+00:00"
          }
        ]
      },
      {
        "comment": "166.88.159.37: Enriched via the circl_passivedns module",
        "deleted": false,
        "description": "Passive DNS records as expressed in draft-dulaunoy-dnsop-passive-dns-cof-07. See https://tools.ietf.org/id/draft-dulaunoy-dnsop-passive-dns-cof-07.html",
        "first_seen": "2024-10-03T05:59:28+00:00",
        "last_seen": "2024-10-03T05:59:28+00:00",
        "meta-category": "network",
        "name": "passive-dns",
        "template_uuid": "b77b7b1c-66ab-4a41-8da4-83810f6d2d6c",
        "template_version": "5",
        "timestamp": "1763467808",
        "uuid": "5104cab3-514a-4070-b1df-ccbff60fba15",
        "Attribute": [
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "count",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "counter",
            "uuid": "a2d02843-3f1d-4c5d-95dc-1c5e3f3d2a19",
            "value": "1"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "origin",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "f0b6d3ce-5ed7-4920-b4fc-22f82516d3e8",
            "value": "https://www.circl.lu/pdns/"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "rrtype",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "ce8228d4-6508-42aa-88fe-f8c7cfff1111",
            "value": "A"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "rrname",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "f13fbe9d-f93f-4749-ab13-ee479849a8fb",
            "value": "166.88.159.37"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "rdata",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "text",
            "uuid": "22a245e6-3f40-445e-a3e5-750ea05d23dd",
            "value": "www.756984.xyz"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "time_first",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "datetime",
            "uuid": "837481b4-8018-458c-89e4-eae14db32142",
            "value": "2024-10-03T05:59:28+00:00"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "time_last",
            "timestamp": "1763467808",
            "to_ids": false,
            "type": "datetime",
            "uuid": "6bfa3ae8-a0c1-4928-ba77-a40bef731365",
            "value": "2024-10-03T05:59:28+00:00"
          }
        ]
      }
    ]
  }
}