{
  "entities": [
    {
      "text": "APT",
      "type": "ORG",
      "confidence": 1.0,
      "name": "APT",
      "id": "APT"
    },
    {
      "text": "Active Directory",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Active Directory",
      "id": "Active Directory"
    },
    {
      "text": "Alert",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Alert",
      "id": "Alert"
    },
    {
      "text": "China",
      "type": "GPE",
      "confidence": 1.0,
      "name": "China",
      "id": "China"
    },
    {
      "text": "China Chopper",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "China Chopper",
      "id": "China Chopper"
    },
    {
      "text": "Cyber Division",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Cyber Division",
      "id": "Cyber Division"
    },
    {
      "text": "CISA",
      "type": "GPE",
      "confidence": 1.0,
      "name": "CISA",
      "id": "CISA"
    },
    {
      "text": "CVE-2020-0611",
      "type": "ORG",
      "confidence": 1.0,
      "name": "CVE-2020-0611",
      "id": "CVE-2020-0611"
    },
    {
      "text": "CERT/CC Vulnerability Note",
      "type": "ORG",
      "confidence": 1.0,
      "name": "CERT/CC Vulnerability Note",
      "id": "CERT/CC Vulnerability Note"
    },
    {
      "text": "Cloudflare",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Cloudflare",
      "id": "Cloudflare"
    },
    {
      "text": "New Zealand",
      "type": "GPE",
      "confidence": 1.0,
      "name": "New Zealand",
      "id": "New Zealand"
    },
    {
      "text": "National Cyber Security Centre",
      "type": "ORG",
      "confidence": 1.0,
      "name": "National Cyber Security Centre",
      "id": "National Cyber Security Centre"
    },
    {
      "text": "network.</li",
      "type": "ORG",
      "confidence": 1.0,
      "name": "network.</li",
      "id": "network.</li"
    },
    {
      "text": "NSA",
      "type": "ORG",
      "confidence": 1.0,
      "name": "NSA",
      "id": "NSA"
    },
    {
      "text": "New York",
      "type": "GPE",
      "confidence": 1.0,
      "name": "New York",
      "id": "New York"
    },
    {
      "text": "target=\"_blank",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "target=\"_blank",
      "id": "target=\"_blank"
    },
    {
      "text": "Tor",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Tor",
      "id": "Tor"
    },
    {
      "text": "TCP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "TCP",
      "id": "TCP"
    },
    {
      "text": "the United States",
      "type": "GPE",
      "confidence": 1.0,
      "name": "the United States",
      "id": "the United States"
    },
    {
      "text": "the Cybersecurity and Infrastructure Security Agency",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Cybersecurity and Infrastructure Security Agency",
      "id": "the Cybersecurity and Infrastructure Security Agency"
    },
    {
      "text": "title=\"(SAP",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "title=\"(SAP",
      "id": "title=\"(SAP"
    },
    {
      "text": "the Microsoft Security Advisory",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Microsoft Security Advisory",
      "id": "the Microsoft Security Advisory"
    },
    {
      "text": "Treasury",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Treasury",
      "id": "Treasury"
    },
    {
      "text": "TA505",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "TA505",
      "id": "TA505"
    },
    {
      "text": "The National Security Agency",
      "type": "ORG",
      "confidence": 1.0,
      "name": "The National Security Agency",
      "id": "The National Security Agency"
    },
    {
      "text": "the NIST Cybersecurity Framework",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the NIST Cybersecurity Framework",
      "id": "the NIST Cybersecurity Framework"
    },
    {
      "text": "the U.S. Department of Justice",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the U.S. Department of Justice",
      "id": "the U.S. Department of Justice"
    },
    {
      "text": "the Windows Remote Desktop Client",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Windows Remote Desktop Client",
      "id": "the Windows Remote Desktop Client"
    },
    {
      "text": "UK",
      "type": "GPE",
      "confidence": 1.0,
      "name": "UK",
      "id": "UK"
    },
    {
      "text": "U.S.",
      "type": "GPE",
      "confidence": 1.0,
      "name": "U.S.",
      "id": "U.S."
    },
    {
      "text": "US",
      "type": "GPE",
      "confidence": 1.0,
      "name": "US",
      "id": "US"
    },
    {
      "text": "li>Port",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Port",
      "id": "li>Port"
    },
    {
      "text": "li>",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>",
      "id": "li>"
    },
    {
      "text": "li>Restrict",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Restrict",
      "id": "li>Restrict"
    },
    {
      "text": "li>Defend",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Defend",
      "id": "li>Defend"
    },
    {
      "text": "li>Maintain",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Maintain",
      "id": "li>Maintain"
    },
    {
      "text": "li>Scan",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Scan",
      "id": "li>Scan"
    },
    {
      "text": "li>Windows",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Windows",
      "id": "li>Windows"
    },
    {
      "text": "Locky",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Locky",
      "id": "Locky"
    },
    {
      "text": "li>Monitor",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Monitor",
      "id": "li>Monitor"
    },
    {
      "text": "li>Proofpoint",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Proofpoint",
      "id": "li>Proofpoint"
    },
    {
      "text": "li>Windows: Monitor",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Windows: Monitor",
      "id": "li>Windows: Monitor"
    },
    {
      "text": "li>Linux",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Linux",
      "id": "li>Linux"
    },
    {
      "text": "li>Network",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Network",
      "id": "li>Network"
    },
    {
      "text": "li>Turn",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Turn",
      "id": "li>Turn"
    },
    {
      "text": "li>Anti-virus",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Anti-virus",
      "id": "li>Anti-virus"
    },
    {
      "text": "li>Analyze",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Analyze",
      "id": "li>Analyze"
    },
    {
      "text": "li>Users",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Users",
      "id": "li>Users"
    },
    {
      "text": "FBI",
      "type": "ORG",
      "confidence": 1.0,
      "name": "FBI",
      "id": "FBI"
    },
    {
      "text": "FTP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "FTP",
      "id": "FTP"
    },
    {
      "text": "Friedex",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Friedex",
      "id": "Friedex"
    },
    {
      "text": "Forbes",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Forbes",
      "id": "Forbes"
    },
    {
      "text": "Fox-IT",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Fox-IT",
      "id": "Fox-IT"
    },
    {
      "text": "Files",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Files",
      "id": "Files"
    },
    {
      "text": "Windows",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Windows",
      "id": "Windows"
    },
    {
      "text": "Justice",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Justice",
      "id": "Justice"
    },
    {
      "text": "Mimikatz",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Mimikatz",
      "id": "Mimikatz"
    },
    {
      "text": "Microsoft",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft",
      "id": "Microsoft"
    },
    {
      "text": "Microsoft Office",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Office",
      "id": "Microsoft Office"
    },
    {
      "text": "Malware Incident Prevention and Handling for Desktops",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Malware Incident Prevention and Handling for Desktops",
      "id": "Malware Incident Prevention and Handling for Desktops"
    },
    {
      "text": "Message Servers",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Message Servers",
      "id": "Message Servers"
    },
    {
      "text": "Microsoft Windows Clients",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Windows Clients",
      "id": "Microsoft Windows Clients"
    },
    {
      "text": "Microsoft Security Advisory",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Security Advisory",
      "id": "Microsoft Security Advisory"
    },
    {
      "text": "Mozilla",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Mozilla",
      "id": "Mozilla"
    },
    {
      "text": "PII",
      "type": "ORG",
      "confidence": 1.0,
      "name": "PII",
      "id": "PII"
    },
    {
      "text": "PHP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "PHP",
      "id": "PHP"
    },
    {
      "text": "PowerShell",
      "type": "ORG",
      "confidence": 1.0,
      "name": "PowerShell",
      "id": "PowerShell"
    },
    {
      "text": "Pulse Secure",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Pulse Secure",
      "id": "Pulse Secure"
    },
    {
      "text": "Software",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Software",
      "id": "Software"
    },
    {
      "text": "SamSam",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SamSam",
      "id": "SamSam"
    },
    {
      "text": "SAP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SAP",
      "id": "SAP"
    },
    {
      "text": "SAR",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SAR",
      "id": "SAR"
    },
    {
      "text": "IP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "IP",
      "id": "IP"
    },
    {
      "text": "Iran",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Iran",
      "id": "Iran"
    },
    {
      "text": "IRGC",
      "type": "ORG",
      "confidence": 1.0,
      "name": "IRGC",
      "id": "IRGC"
    },
    {
      "text": "ISC Stormcast",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ISC Stormcast",
      "id": "ISC Stormcast"
    },
    {
      "text": "href=\"https://owasp.org",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://owasp.org",
      "id": "href=\"https://owasp.org"
    },
    {
      "text": "href=\"https://cloud.google.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://cloud.google.com",
      "id": "href=\"https://cloud.google.com"
    },
    {
      "text": "href=\"https://support.microsoft.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://support.microsoft.com",
      "id": "href=\"https://support.microsoft.com"
    },
    {
      "text": "href=\"https://learn.microsoft.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://learn.microsoft.com",
      "id": "href=\"https://learn.microsoft.com"
    },
    {
      "text": "HTran",
      "type": "ORG",
      "confidence": 1.0,
      "name": "HTran",
      "id": "HTran"
    },
    {
      "text": "href=\"https://github.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://github.com",
      "id": "href=\"https://github.com"
    },
    {
      "text": "Hacking",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Hacking",
      "id": "Hacking"
    },
    {
      "text": "DNS",
      "type": "ORG",
      "confidence": 1.0,
      "name": "DNS",
      "id": "DNS"
    },
    {
      "text": "Desktop Services",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Desktop Services",
      "id": "Desktop Services"
    },
    {
      "text": "Dridex",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Dridex",
      "id": "Dridex"
    },
    {
      "text": "doc",
      "type": "ORG",
      "confidence": 1.0,
      "name": "doc",
      "id": "doc"
    },
    {
      "text": "br><strong",
      "type": "GPE",
      "confidence": 1.0,
      "name": "br><strong",
      "id": "br><strong"
    },
    {
      "text": "Bugat",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Bugat",
      "id": "Bugat"
    },
    {
      "text": "BitPaymer",
      "type": "ORG",
      "confidence": 1.0,
      "name": "BitPaymer",
      "id": "BitPaymer"
    },
    {
      "text": "BitPaymer Gangs Linked",
      "type": "ORG",
      "confidence": 1.0,
      "name": "BitPaymer Gangs Linked",
      "id": "BitPaymer Gangs Linked"
    },
    {
      "text": "OPCDE",
      "type": "ORG",
      "confidence": 1.0,
      "name": "OPCDE",
      "id": "OPCDE"
    },
    {
      "text": "Onerep",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Onerep",
      "id": "Onerep"
    },
    {
      "text": "KrebsOnSecurity",
      "type": "ORG",
      "confidence": 1.0,
      "name": "KrebsOnSecurity",
      "id": "KrebsOnSecurity"
    },
    {
      "text": "RDP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "RDP",
      "id": "RDP"
    },
    {
      "text": "Remote Desktop Services",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Remote Desktop Services",
      "id": "Remote Desktop Services"
    },
    {
      "text": "Russia",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Russia",
      "id": "Russia"
    },
    {
      "text": "Run Keys/Startup",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Run Keys/Startup",
      "id": "Run Keys/Startup"
    },
    {
      "text": "Rey",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Rey",
      "id": "Rey"
    },
    {
      "text": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Guide to Malware Incident Prevention and Handling for Desktops",
      "id": "Guide to Malware Incident Prevention and Handling for Desktops"
    },
    {
      "text": "Advanced Persistent Threat",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Advanced Persistent Threat",
      "id": "Advanced Persistent Threat"
    },
    {
      "text": "Earned ‘Evil Corp’ Cybercriminals At Least $50 Million",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Earned ‘Evil Corp’ Cybercriminals At Least $50 Million",
      "id": "Earned ‘Evil Corp’ Cybercriminals At Least $50 Million"
    },
    {
      "text": "href=\"https://reliaquest.com/blog",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://reliaquest.com/blog",
      "id": "href=\"https://reliaquest.com/blog"
    },
    {
      "text": "the Islamic Revolutionary Guard Corps",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Islamic Revolutionary Guard Corps",
      "id": "the Islamic Revolutionary Guard Corps"
    },
    {
      "text": "Dridex Malware",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Dridex Malware",
      "id": "Dridex Malware"
    },
    {
      "text": "Windows Remote Desktop&nbsp;Client",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Windows Remote Desktop&nbsp;Client",
      "id": "Windows Remote Desktop&nbsp;Client"
    },
    {
      "text": "the State of Hawaii",
      "type": "GPE",
      "confidence": 1.0,
      "name": "the State of Hawaii",
      "id": "the State of Hawaii"
    },
    {
      "text": "Securing Active",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Securing Active",
      "id": "Securing Active"
    },
    {
      "text": "DNS Hijacking Campaign",
      "type": "ORG",
      "confidence": 1.0,
      "name": "DNS Hijacking Campaign",
      "id": "DNS Hijacking Campaign"
    },
    {
      "text": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "id": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov"
    },
    {
      "text": "Google Ads",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Google Ads",
      "id": "Google Ads"
    },
    {
      "text": "Australia",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Australia",
      "id": "Australia"
    },
    {
      "text": "Canada",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Canada",
      "id": "Canada"
    },
    {
      "text": "the United Kingdom",
      "type": "GPE",
      "confidence": 1.0,
      "name": "the United Kingdom",
      "id": "the United Kingdom"
    },
    {
      "text": "United",
      "type": "ORG",
      "confidence": 1.0,
      "name": "United",
      "id": "United"
    },
    {
      "text": "li>Webshell",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Webshell",
      "id": "li>Webshell"
    },
    {
      "text": "li>Credential Stealer",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Credential Stealer",
      "id": "li>Credential Stealer"
    },
    {
      "text": "li>C2 Obfuscation",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>C2 Obfuscation",
      "id": "li>C2 Obfuscation"
    },
    {
      "text": "Frutas",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Frutas",
      "id": "Frutas"
    },
    {
      "text": "Wireshark",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Wireshark",
      "id": "Wireshark"
    },
    {
      "text": "Quasar",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Quasar",
      "id": "Quasar"
    },
    {
      "text": "Java",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Java",
      "id": "Java"
    },
    {
      "text": "MAC",
      "type": "ORG",
      "confidence": 1.0,
      "name": "MAC",
      "id": "MAC"
    },
    {
      "text": "Society for Worldwide Interbank Financial Telecommunication",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Society for Worldwide Interbank Financial Telecommunication",
      "id": "Society for Worldwide Interbank Financial Telecommunication"
    },
    {
      "text": "Windows Registry",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Windows Registry",
      "id": "Windows Registry"
    },
    {
      "text": "li>Significant",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Significant",
      "id": "li>Significant"
    },
    {
      "text": "The United Kingdom National Cyber Security Centre",
      "type": "ORG",
      "confidence": 1.0,
      "name": "The United Kingdom National Cyber Security Centre",
      "id": "The United Kingdom National Cyber Security Centre"
    },
    {
      "text": ">China Chopper",
      "type": "ORG",
      "confidence": 1.0,
      "name": ">China Chopper",
      "id": ">China Chopper"
    },
    {
      "text": "CVE-2017-3066",
      "type": "ORG",
      "confidence": 1.0,
      "name": "CVE-2017-3066",
      "id": "CVE-2017-3066"
    },
    {
      "text": "Adobe ColdFusion",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Adobe ColdFusion",
      "id": "Adobe ColdFusion"
    },
    {
      "text": "Transport Layer Security",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Transport Layer Security",
      "id": "Transport Layer Security"
    },
    {
      "text": "Linux",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Linux",
      "id": "Linux"
    },
    {
      "text": "Hypertext Preprocessor",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Hypertext Preprocessor",
      "id": "Hypertext Preprocessor"
    },
    {
      "text": "Local Security Authority Subsystem Service",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Local Security Authority Subsystem Service",
      "id": "Local Security Authority Subsystem Service"
    },
    {
      "text": "Local Area Network",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Local Area Network",
      "id": "Local Area Network"
    },
    {
      "text": "Invoke-Mimikatz",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Invoke-Mimikatz",
      "id": "Invoke-Mimikatz"
    },
    {
      "text": "DigiNotar",
      "type": "ORG",
      "confidence": 1.0,
      "name": "DigiNotar",
      "id": "DigiNotar"
    },
    {
      "text": "NotPetya",
      "type": "ORG",
      "confidence": 1.0,
      "name": "NotPetya",
      "id": "NotPetya"
    },
    {
      "text": "BadRabbit",
      "type": "ORG",
      "confidence": 1.0,
      "name": "BadRabbit",
      "id": "BadRabbit"
    },
    {
      "text": "Windows 8.1/Server",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Windows 8.1/Server",
      "id": "Windows 8.1/Server"
    },
    {
      "text": "Credential Guard.</p>\n<p>Credential Guard",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Credential Guard.</p>\n<p>Credential Guard",
      "id": "Credential Guard.</p>\n<p>Credential Guard"
    },
    {
      "text": "Windows Hardware Compatibility Program Specifications",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Windows Hardware Compatibility Program Specifications",
      "id": "Windows Hardware Compatibility Program Specifications"
    },
    {
      "text": "Domain",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Domain",
      "id": "Domain"
    },
    {
      "text": "Local Administrator Password Solution",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Local Administrator Password Solution",
      "id": "Local Administrator Password Solution"
    },
    {
      "text": "Microsoft Advanced Threat Analytics",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Advanced Threat Analytics",
      "id": "Microsoft Advanced Threat Analytics"
    },
    {
      "text": "Numerous Mimikatz",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Numerous Mimikatz",
      "id": "Numerous Mimikatz"
    },
    {
      "text": "Wherever Mimikatz",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Wherever Mimikatz",
      "id": "Wherever Mimikatz"
    },
    {
      "text": ">Lateral Movement Framework",
      "type": "ORG",
      "confidence": 1.0,
      "name": ">Lateral Movement Framework",
      "id": ">Lateral Movement Framework"
    },
    {
      "text": "Cobalt Strike",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Cobalt Strike",
      "id": "Cobalt Strike"
    },
    {
      "text": "Metasploit",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Metasploit",
      "id": "Metasploit"
    },
    {
      "text": "Transmission Control Protocol",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Transmission Control Protocol",
      "id": "Transmission Control Protocol"
    },
    {
      "text": "li>Evade",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Evade",
      "id": "li>Evade"
    },
    {
      "text": "tran)</strong> - One",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "tran)</strong> - One",
      "id": "tran)</strong> - One"
    },
    {
      "text": "ProgramData",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ProgramData",
      "id": "ProgramData"
    },
    {
      "text": "li>Board",
      "type": "ORG",
      "confidence": 1.0,
      "name": "li>Board",
      "id": "li>Board"
    },
    {
      "text": "li>Update",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Update",
      "id": "li>Update"
    },
    {
      "text": "Office",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Office",
      "id": "Office"
    },
    {
      "text": "NCSC’s Macro Security",
      "type": "ORG",
      "confidence": 1.0,
      "name": "NCSC’s Macro Security",
      "id": "NCSC’s Macro Security"
    },
    {
      "text": "Anti-Virus",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Anti-Virus",
      "id": "Anti-Virus"
    },
    {
      "text": "Anti-Virus Software</a>.<br>See",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Anti-Virus Software</a>.<br>See",
      "id": "Anti-Virus Software</a>.<br>See"
    },
    {
      "text": "li>Layer",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Layer",
      "id": "li>Layer"
    },
    {
      "text": "li>Treat",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Treat",
      "id": "li>Treat"
    },
    {
      "text": "Social Engineering",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Social Engineering",
      "id": "Social Engineering"
    },
    {
      "text": "li>Deploy",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Deploy",
      "id": "li>Deploy"
    },
    {
      "text": "li>Make",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Make",
      "id": "li>Make"
    },
    {
      "text": ">Additional Resources",
      "type": "ORG",
      "confidence": 1.0,
      "name": ">Additional Resources",
      "id": ">Additional Resources"
    },
    {
      "text": "li>ACSC",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>ACSC",
      "id": "li>ACSC"
    },
    {
      "text": "li>Canadian Centre",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Canadian Centre",
      "id": "li>Canadian Centre"
    },
    {
      "text": "Hygiene - Cyber",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Hygiene - Cyber",
      "id": "Hygiene - Cyber"
    },
    {
      "text": "Critical Controls 2018",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Critical Controls 2018",
      "id": "Critical Controls 2018"
    },
    {
      "text": "NCSC",
      "type": "ORG",
      "confidence": 1.0,
      "name": "NCSC",
      "id": "NCSC"
    },
    {
      "text": "Cyber Security\">10 Steps",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Cyber Security\">10 Steps",
      "id": "Cyber Security\">10 Steps"
    },
    {
      "text": "href=\"https://myservices.cisa.gov",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://myservices.cisa.gov",
      "id": "href=\"https://myservices.cisa.gov"
    },
    {
      "text": "NZ",
      "type": "GPE",
      "confidence": 1.0,
      "name": "NZ",
      "id": "NZ"
    },
    {
      "text": "href=\"https://www.ncsc.gov.uk/",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://www.ncsc.gov.uk/",
      "id": "href=\"https://www.ncsc.gov.uk/"
    },
    {
      "text": "Kingdom National Cyber Security Centre\">UK",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Kingdom National Cyber Security Centre\">UK",
      "id": "Kingdom National Cyber Security Centre\">UK"
    },
    {
      "text": "Top Ten\">OWASP",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Top Ten\">OWASP",
      "id": "Top Ten\">OWASP"
    },
    {
      "text": "the China Chopper Web Shell - Part II",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the China Chopper Web Shell - Part II",
      "id": "the China Chopper Web Shell - Part II"
    },
    {
      "text": "Securing Active Directory\">Best Practices for",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Securing Active Directory\">Best Practices for",
      "id": "Securing Active Directory\">Best Practices for"
    },
    {
      "text": "The Department of Homeland Security",
      "type": "ORG",
      "confidence": 1.0,
      "name": "The Department of Homeland Security",
      "id": "The Department of Homeland Security"
    },
    {
      "text": "National Cybersecurity and Communications Integration Center",
      "type": "ORG",
      "confidence": 1.0,
      "name": "National Cybersecurity and Communications Integration Center",
      "id": "National Cybersecurity and Communications Integration Center"
    },
    {
      "text": "the Federal Bureau of Investigation (FBI",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Federal Bureau of Investigation (FBI",
      "id": "the Federal Bureau of Investigation (FBI"
    },
    {
      "text": "MSIL/Samas",
      "type": "ORG",
      "confidence": 1.0,
      "name": "MSIL/Samas",
      "id": "MSIL/Samas"
    },
    {
      "text": "the JexBoss Exploit Kit",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the JexBoss Exploit Kit",
      "id": "the JexBoss Exploit Kit"
    },
    {
      "text": "JBoss",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "JBoss",
      "id": "JBoss"
    },
    {
      "text": "Remote Desktop Protocol",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Remote Desktop Protocol",
      "id": "Remote Desktop Protocol"
    },
    {
      "text": "SamSam Malware Analysis Reports",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SamSam Malware Analysis Reports",
      "id": "SamSam Malware Analysis Reports"
    },
    {
      "text": "Ransomware</a>.</p",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Ransomware</a>.</p",
      "id": "Ransomware</a>.</p"
    },
    {
      "text": "DHS",
      "type": "ORG",
      "confidence": 1.0,
      "name": "DHS",
      "id": "DHS"
    },
    {
      "text": "li>Verify",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Verify",
      "id": "li>Verify"
    },
    {
      "text": "li>Regularly",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Regularly",
      "id": "li>Regularly"
    },
    {
      "text": "li>Minimize",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Minimize",
      "id": "li>Minimize"
    },
    {
      "text": "Special Publication",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Special Publication",
      "id": "Special Publication"
    },
    {
      "text": "li>FBI",
      "type": "ORG",
      "confidence": 1.0,
      "name": "li>FBI",
      "id": "li>FBI"
    },
    {
      "text": "href=\"https://nvlpubs.nist.gov",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://nvlpubs.nist.gov",
      "id": "href=\"https://nvlpubs.nist.gov"
    },
    {
      "text": "The National Cybersecurity and Communications Integration Center",
      "type": "ORG",
      "confidence": 1.0,
      "name": "The National Cybersecurity and Communications Integration Center",
      "id": "The National Cybersecurity and Communications Integration Center"
    },
    {
      "text": "Domain Name System",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Domain Name System",
      "id": "Domain Name System"
    },
    {
      "text": "li>Next",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Next",
      "id": "li>Next"
    },
    {
      "text": "Address",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Address",
      "id": "Address"
    },
    {
      "text": "Mail Exchanger",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Mail Exchanger",
      "id": "Mail Exchanger"
    },
    {
      "text": "NS",
      "type": "GPE",
      "confidence": 1.0,
      "name": "NS",
      "id": "NS"
    },
    {
      "text": "redirection.</li",
      "type": "ORG",
      "confidence": 1.0,
      "name": "redirection.</li",
      "id": "redirection.</li"
    },
    {
      "text": "li>Search",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Search",
      "id": "li>Search"
    },
    {
      "text": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "ORG",
      "confidence": 1.0,
      "name": "DNSpionage Campaign Targets Middle East</a></li>",
      "id": "DNSpionage Campaign Targets Middle East</a></li>"
    },
    {
      "text": "Cloud Blog</a></li>",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Cloud Blog</a></li>",
      "id": "Cloud Blog</a></li>"
    },
    {
      "text": "li>Crowdstrike",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Crowdstrike",
      "id": "li>Crowdstrike"
    },
    {
      "text": "Crowdstrike",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Crowdstrike",
      "id": "Crowdstrike"
    },
    {
      "text": "Operation for Community Development and Empowerment",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Operation for Community Development and Empowerment",
      "id": "Operation for Community Development and Empowerment"
    },
    {
      "text": "SAP Gateway",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "SAP Gateway",
      "id": "SAP Gateway"
    },
    {
      "text": "Application Servers",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Application Servers",
      "id": "Application Servers"
    },
    {
      "text": "Snort",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Snort",
      "id": "Snort"
    },
    {
      "text": "SAP Exploit",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "SAP Exploit",
      "id": "SAP Exploit"
    },
    {
      "text": "distance:0",
      "type": "ORG",
      "confidence": 1.0,
      "name": "distance:0",
      "id": "distance:0"
    },
    {
      "text": "SAP Message Server",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SAP Message Server",
      "id": "SAP Message Server"
    },
    {
      "text": "ACL",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ACL",
      "id": "ACL"
    },
    {
      "text": "Gateways",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Gateways",
      "id": "Gateways"
    },
    {
      "text": "Split MS",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Split MS",
      "id": "Split MS"
    },
    {
      "text": "SNC",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SNC",
      "id": "SNC"
    },
    {
      "text": "clients.</li",
      "type": "ORG",
      "confidence": 1.0,
      "name": "clients.</li",
      "id": "clients.</li"
    },
    {
      "text": "li>Remove",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Remove",
      "id": "li>Remove"
    },
    {
      "text": "Mathieu Geli\">Comae Technologies:",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Mathieu Geli\">Comae Technologies:",
      "id": "Mathieu Geli\">Comae Technologies:"
    },
    {
      "text": "Community Development and Empowerment",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Community Development and Empowerment",
      "id": "Community Development and Empowerment"
    },
    {
      "text": "Gateway Access Control Lists",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Gateway Access Control Lists",
      "id": "Gateway Access Control Lists"
    },
    {
      "text": "br>[5",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "br>[5",
      "id": "br>[5"
    },
    {
      "text": "Microsoft Windows Operating Systems",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Windows Operating Systems",
      "id": "Microsoft Windows Operating Systems"
    },
    {
      "text": "the Remote Desktop Protocol",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Remote Desktop Protocol",
      "id": "the Remote Desktop Protocol"
    },
    {
      "text": "the Microsoft Windows",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Microsoft Windows",
      "id": "the Microsoft Windows"
    },
    {
      "text": "WannaCry",
      "type": "ORG",
      "confidence": 1.0,
      "name": "WannaCry",
      "id": "WannaCry"
    },
    {
      "text": "Windows Vista",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Windows Vista",
      "id": "Windows Vista"
    },
    {
      "text": "White House Press Briefing",
      "type": "ORG",
      "confidence": 1.0,
      "name": "White House Press Briefing",
      "id": "White House Press Briefing"
    },
    {
      "text": "North Korea",
      "type": "GPE",
      "confidence": 1.0,
      "name": "North Korea",
      "id": "North Korea"
    },
    {
      "text": "li>Upgrade",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Upgrade",
      "id": "li>Upgrade"
    },
    {
      "text": "li>Identify",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Identify",
      "id": "li>Identify"
    },
    {
      "text": "li>Establish",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Establish",
      "id": "li>Establish"
    },
    {
      "text": "Microsoft End of Support FAQ</a></div",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft End of Support FAQ</a></div",
      "id": "Microsoft End of Support FAQ</a></div"
    },
    {
      "text": "Microsoft Windows Upgrade",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Windows Upgrade",
      "id": "Microsoft Windows Upgrade"
    },
    {
      "text": "Migration Considerations</a></div>\n",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Migration Considerations</a></div>\n",
      "id": "Migration Considerations</a></div>\n"
    },
    {
      "text": "ComputerWorld",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ComputerWorld",
      "id": "ComputerWorld"
    },
    {
      "text": "Microsoft Office 365 Security",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Office 365 Security",
      "id": "Microsoft Office 365 Security"
    },
    {
      "text": "the Department of the Treasury Financial",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Department of the Treasury Financial",
      "id": "the Department of the Treasury Financial"
    },
    {
      "text": "Cyber Information Group",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Cyber Information Group",
      "id": "Cyber Information Group"
    },
    {
      "text": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "id": "the Department of the Treasury’s Financial Crimes Enforcement Network"
    },
    {
      "text": "Sanctions Evil Corp",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Sanctions Evil Corp",
      "id": "Sanctions Evil Corp"
    },
    {
      "text": "ZIP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ZIP",
      "id": "ZIP"
    },
    {
      "text": "Visual Basic",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Visual Basic",
      "id": "Visual Basic"
    },
    {
      "text": "JavaScript",
      "type": "ORG",
      "confidence": 1.0,
      "name": "JavaScript",
      "id": "JavaScript"
    },
    {
      "text": "CVE-2017-0199",
      "type": "ORG",
      "confidence": 1.0,
      "name": "CVE-2017-0199",
      "id": "CVE-2017-0199"
    },
    {
      "text": "WordPad",
      "type": "ORG",
      "confidence": 1.0,
      "name": "WordPad",
      "id": "WordPad"
    },
    {
      "text": "files.&nbsp",
      "type": "ORG",
      "confidence": 1.0,
      "name": "files.&nbsp",
      "id": "files.&nbsp"
    },
    {
      "text": "API",
      "type": "ORG",
      "confidence": 1.0,
      "name": "API",
      "id": "API"
    },
    {
      "text": "XML",
      "type": "ORG",
      "confidence": 1.0,
      "name": "XML",
      "id": "XML"
    },
    {
      "text": "Cridex",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Cridex",
      "id": "Cridex"
    },
    {
      "text": "Zepto",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Zepto",
      "id": "Zepto"
    },
    {
      "text": "Osiris",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Osiris",
      "id": "Osiris"
    },
    {
      "text": "Evil Corp",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Evil Corp",
      "id": "Evil Corp"
    },
    {
      "text": "li>Contact",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Contact",
      "id": "li>Contact"
    },
    {
      "text": "“Cyber Event Indicators",
      "type": "ORG",
      "confidence": 1.0,
      "name": "“Cyber Event Indicators",
      "id": "“Cyber Event Indicators"
    },
    {
      "text": "Dridex TTPs:</p>",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Dridex TTPs:</p>",
      "id": "Dridex TTPs:</p>"
    },
    {
      "text": "li>Conduct",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Conduct",
      "id": "li>Conduct"
    },
    {
      "text": "li>Treasury",
      "type": "ORG",
      "confidence": 1.0,
      "name": "li>Treasury",
      "id": "li>Treasury"
    },
    {
      "text": "engines.</li",
      "type": "GPE",
      "confidence": 1.0,
      "name": "engines.</li",
      "id": "engines.</li"
    },
    {
      "text": "li>Keep",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Keep",
      "id": "li>Keep"
    },
    {
      "text": "li>Enforce",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Enforce",
      "id": "li>Enforce"
    },
    {
      "text": "USB",
      "type": "ORG",
      "confidence": 1.0,
      "name": "USB",
      "id": "USB"
    },
    {
      "text": "Strategies",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Strategies",
      "id": "Strategies"
    },
    {
      "text": "a Privileged Access Management (PAM",
      "type": "ORG",
      "confidence": 1.0,
      "name": "a Privileged Access Management (PAM",
      "id": "a Privileged Access Management (PAM"
    },
    {
      "text": "ransomware.</li>\n<li><strong>",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ransomware.</li>\n<li><strong>",
      "id": "ransomware.</li>\n<li><strong>"
    },
    {
      "text": "Security Information and Event Management",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Security Information and Event Management",
      "id": "Security Information and Event Management"
    },
    {
      "text": "Endpoint Detection and Response",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Endpoint Detection and Response",
      "id": "Endpoint Detection and Response"
    },
    {
      "text": "EDR",
      "type": "ORG",
      "confidence": 1.0,
      "name": "EDR",
      "id": "EDR"
    },
    {
      "text": "Unified Extensible Firmware Interface",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Unified Extensible Firmware Interface",
      "id": "Unified Extensible Firmware Interface"
    },
    {
      "text": "IPs",
      "type": "ORG",
      "confidence": 1.0,
      "name": "IPs",
      "id": "IPs"
    },
    {
      "text": "Multi-Factor Authentication",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Multi-Factor Authentication",
      "id": "Multi-Factor Authentication"
    },
    {
      "text": "Bank Secrecy Act",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Bank Secrecy Act",
      "id": "Bank Secrecy Act"
    },
    {
      "text": "FinCEN",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "FinCEN",
      "id": "FinCEN"
    },
    {
      "text": "Financial",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Financial",
      "id": "Financial"
    },
    {
      "text": "the FinCEN Resource Center",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the FinCEN Resource Center",
      "id": "the FinCEN Resource Center"
    },
    {
      "text": "Malware",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Malware",
      "id": "Malware"
    },
    {
      "text": "Threat Profile",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Threat Profile",
      "id": "Threat Profile"
    },
    {
      "text": "New Jersey Cybersecurity &amp",
      "type": "ORG",
      "confidence": 1.0,
      "name": "New Jersey Cybersecurity &amp",
      "id": "New Jersey Cybersecurity &amp"
    },
    {
      "text": "Communications Integration Cell",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Communications Integration Cell",
      "id": "Communications Integration Cell"
    },
    {
      "text": "li>Alert Logic",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Alert Logic",
      "id": "li>Alert Logic"
    },
    {
      "text": "Locky Ransomware",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Locky Ransomware",
      "id": "Locky Ransomware"
    },
    {
      "text": "Locky Ransomware\">https://www.alertlogic.com/resources",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Locky Ransomware\">https://www.alertlogic.com/resources",
      "id": "Locky Ransomware\">https://www.alertlogic.com/resources"
    },
    {
      "text": "li>Avast Blog",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Avast Blog",
      "id": "li>Avast Blog"
    },
    {
      "text": "href=\"https://blog.avast.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://blog.avast.com",
      "id": "href=\"https://blog.avast.com"
    },
    {
      "text": "the Locky ransomware\">https://blog.avast.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Locky ransomware\">https://blog.avast.com",
      "id": "the Locky ransomware\">https://blog.avast.com"
    },
    {
      "text": "li>Brett Stone-Gross",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Brett Stone-Gross",
      "id": "li>Brett Stone-Gross"
    },
    {
      "text": "Secureworks",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Secureworks",
      "id": "Secureworks"
    },
    {
      "text": "li>Brewster",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Brewster",
      "id": "li>Brewster"
    },
    {
      "text": "Thomas",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Thomas",
      "id": "Thomas"
    },
    {
      "text": "Knock Down Dridex Malware",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Knock Down Dridex Malware",
      "id": "Knock Down Dridex Malware"
    },
    {
      "text": "li>Chandler",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Chandler",
      "id": "li>Chandler"
    },
    {
      "text": "Andy",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Andy",
      "id": "Andy"
    },
    {
      "text": "https://www.fox-it.com/en/about-fox-it/corporate/news/fbi-announces-dridex-gang-indictments-praises-fox/",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "https://www.fox-it.com/en/about-fox-it/corporate/news/fbi-announces-dridex-gang-indictments-praises-fox/",
      "id": "https://www.fox-it.com/en/about-fox-it/corporate/news/fbi-announces-dridex-gang-indictments-praises-fox/"
    },
    {
      "text": "li>DHS",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>DHS",
      "id": "li>DHS"
    },
    {
      "text": "Eduard Kovacs",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Eduard Kovacs",
      "id": "Eduard Kovacs"
    },
    {
      "text": "li>Geoff White",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Geoff White",
      "id": "li>Geoff White"
    },
    {
      "text": "li>MS-ISAC",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>MS-ISAC",
      "id": "li>MS-ISAC"
    },
    {
      "text": "li>O’Brien",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>O’Brien",
      "id": "li>O’Brien"
    },
    {
      "text": "Dick",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Dick",
      "id": "Dick"
    },
    {
      "text": "Trojan",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Trojan",
      "id": "Trojan"
    },
    {
      "text": "li>Poslušný",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Poslušný",
      "id": "li>Poslušný"
    },
    {
      "text": "Michal",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Michal",
      "id": "Michal"
    },
    {
      "text": "ESET",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ESET",
      "id": "ESET"
    },
    {
      "text": "href=\"https://www.welivesecurity.com/2018/01/26",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://www.welivesecurity.com/2018/01/26",
      "id": "href=\"https://www.welivesecurity.com/2018/01/26"
    },
    {
      "text": "Microsoft Zero-Day\">https://www.proofpoint.com/us",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Microsoft Zero-Day\">https://www.proofpoint.com/us",
      "id": "Microsoft Zero-Day\">https://www.proofpoint.com/us"
    },
    {
      "text": "Trojan Campaigns Return",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Trojan Campaigns Return",
      "id": "Trojan Campaigns Return"
    },
    {
      "text": "href=\"https://www.cisa.gov//www.proofpoint.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://www.cisa.gov//www.proofpoint.com",
      "id": "href=\"https://www.cisa.gov//www.proofpoint.com"
    },
    {
      "text": "GlobeImposter\">https://www.proofpoint.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "GlobeImposter\">https://www.proofpoint.com",
      "id": "GlobeImposter\">https://www.proofpoint.com"
    },
    {
      "text": "Ran Mosessco",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Ran Mosessco",
      "id": "Ran Mosessco"
    },
    {
      "text": "ForcePoint",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ForcePoint",
      "id": "ForcePoint"
    },
    {
      "text": "https://blogs.forcepoint.com/blog/security-labs/new-year-new-look-dridex-compromised-ftp",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "https://blogs.forcepoint.com/blog/security-labs/new-year-new-look-dridex-compromised-ftp",
      "id": "https://blogs.forcepoint.com/blog/security-labs/new-year-new-look-dridex-compromised-ftp"
    },
    {
      "text": "li>Sanghavi",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Sanghavi",
      "id": "li>Sanghavi"
    },
    {
      "text": "Mithun",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Mithun",
      "id": "Mithun"
    },
    {
      "text": "href=\"https://community.broadcom.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://community.broadcom.com",
      "id": "href=\"https://community.broadcom.com"
    },
    {
      "text": "title=\"DRIDEX",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "title=\"DRIDEX",
      "id": "title=\"DRIDEX"
    },
    {
      "text": "it\">https://community.broadcom.com",
      "type": "ORG",
      "confidence": 1.0,
      "name": "it\">https://community.broadcom.com",
      "id": "it\">https://community.broadcom.com"
    },
    {
      "text": "Intelligence Blog",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Intelligence Blog",
      "id": "Intelligence Blog"
    },
    {
      "text": "URSNIF",
      "type": "ORG",
      "confidence": 1.0,
      "name": "URSNIF",
      "id": "URSNIF"
    },
    {
      "text": "EMOTET",
      "type": "ORG",
      "confidence": 1.0,
      "name": "EMOTET",
      "id": "EMOTET"
    },
    {
      "text": "Trend Micro",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Trend Micro",
      "id": "Trend Micro"
    },
    {
      "text": "title=\"URSNIF",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "title=\"URSNIF",
      "id": "title=\"URSNIF"
    },
    {
      "text": "li>Talos Group",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Talos Group",
      "id": "li>Talos Group"
    },
    {
      "text": "Cisco Blogs",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Cisco Blogs",
      "id": "Cisco Blogs"
    },
    {
      "text": "Nation",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Nation",
      "id": "Nation"
    },
    {
      "text": "the Islamic Republic of Iran",
      "type": "GPE",
      "confidence": 1.0,
      "name": "the Islamic Republic of Iran",
      "id": "the Islamic Republic of Iran"
    },
    {
      "text": "Contact Information",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Contact Information",
      "id": "Contact Information"
    },
    {
      "text": "Mid-2013 - DDoS",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Mid-2013 - DDoS",
      "id": "Mid-2013 - DDoS"
    },
    {
      "text": "SCADA",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SCADA",
      "id": "SCADA"
    },
    {
      "text": "Rye",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Rye",
      "id": "Rye"
    },
    {
      "text": "Las Vegas",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Las Vegas",
      "id": "Las Vegas"
    },
    {
      "text": "Nevada",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Nevada",
      "id": "Nevada"
    },
    {
      "text": "Social Security Numbers",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Social Security Numbers",
      "id": "Social Security Numbers"
    },
    {
      "text": "Bloomberg",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Bloomberg",
      "id": "Bloomberg"
    },
    {
      "text": "Sands",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Sands",
      "id": "Sands"
    },
    {
      "text": "National Intelligence",
      "type": "ORG",
      "confidence": 1.0,
      "name": "National Intelligence",
      "id": "National Intelligence"
    },
    {
      "text": "the House Permanent Select Committee",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the House Permanent Select Committee",
      "id": "the House Permanent Select Committee"
    },
    {
      "text": "the U.S. Justice Department",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the U.S. Justice Department",
      "id": "the U.S. Justice Department"
    },
    {
      "text": "the Mabna Institute",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Mabna Institute",
      "id": "the Mabna Institute"
    },
    {
      "text": "the Federal Energy Regulatory Commission",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Federal Energy Regulatory Commission",
      "id": "the Federal Energy Regulatory Commission"
    },
    {
      "text": "the United Nations",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the United Nations",
      "id": "the United Nations"
    },
    {
      "text": "the United Nations Children’s Fund",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the United Nations Children’s Fund",
      "id": "the United Nations Children’s Fund"
    },
    {
      "text": "equipment.</strong> Focus",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "equipment.</strong> Focus",
      "id": "equipment.</strong> Focus"
    },
    {
      "text": "the Antimalware Scan Interface",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the Antimalware Scan Interface",
      "id": "the Antimalware Scan Interface"
    },
    {
      "text": "AMSI",
      "type": "ORG",
      "confidence": 1.0,
      "name": "AMSI",
      "id": "AMSI"
    },
    {
      "text": "li>Set PowerShell",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Set PowerShell",
      "id": "li>Set PowerShell"
    },
    {
      "text": "li>Remove PowerShell",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Remove PowerShell",
      "id": "li>Remove PowerShell"
    },
    {
      "text": "the WinRM Service",
      "type": "ORG",
      "confidence": 1.0,
      "name": "the WinRM Service",
      "id": "the WinRM Service"
    },
    {
      "text": "li>Restrict PowerShell",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Restrict PowerShell",
      "id": "li>Restrict PowerShell"
    },
    {
      "text": "System",
      "type": "ORG",
      "confidence": 1.0,
      "name": "System",
      "id": "System"
    },
    {
      "text": "Management.Automation.dll",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Management.Automation.dll",
      "id": "Management.Automation.dll"
    },
    {
      "text": "Initial Access",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Initial Access",
      "id": "Initial Access"
    },
    {
      "text": "Deobfuscate/Decode Files or Information",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Deobfuscate/Decode Files or Information",
      "id": "Deobfuscate/Decode Files or Information"
    },
    {
      "text": "li>Endpoint",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Endpoint",
      "id": "li>Endpoint"
    },
    {
      "text": "PDF",
      "type": "ORG",
      "confidence": 1.0,
      "name": "PDF",
      "id": "PDF"
    },
    {
      "text": "Exploitation for Client Execution",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Exploitation for Client Execution",
      "id": "Exploitation for Client Execution"
    },
    {
      "text": "Group Policy",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Group Policy",
      "id": "Group Policy"
    },
    {
      "text": "VBScript",
      "type": "ORG",
      "confidence": 1.0,
      "name": "VBScript",
      "id": "VBScript"
    },
    {
      "text": "li>Scripts",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Scripts",
      "id": "li>Scripts"
    },
    {
      "text": "Sysinternals Autoruns",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Sysinternals Autoruns",
      "id": "Sysinternals Autoruns"
    },
    {
      "text": "Command",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Command",
      "id": "Command"
    },
    {
      "text": "File Copy\">Remote File Copy</a></td",
      "type": "ORG",
      "confidence": 1.0,
      "name": "File Copy\">Remote File Copy</a></td",
      "id": "File Copy\">Remote File Copy</a></td"
    },
    {
      "text": "SMB.</li",
      "type": "GPE",
      "confidence": 1.0,
      "name": "SMB.</li",
      "id": "SMB.</li"
    },
    {
      "text": "Obfuscated Files",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Obfuscated Files",
      "id": "Obfuscated Files"
    },
    {
      "text": "li><a",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li><a",
      "id": "li><a"
    },
    {
      "text": "Meh Chang",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Meh Chang",
      "id": "Meh Chang"
    },
    {
      "text": "Orange Tsai",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Orange Tsai",
      "id": "Orange Tsai"
    },
    {
      "text": "VPN",
      "type": "ORG",
      "confidence": 1.0,
      "name": "VPN",
      "id": "VPN"
    },
    {
      "text": "Cybersecurity Advisory on Pulse Secure",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Cybersecurity Advisory on Pulse Secure",
      "id": "Cybersecurity Advisory on Pulse Secure"
    },
    {
      "text": "CERT/CC",
      "type": "ORG",
      "confidence": 1.0,
      "name": "CERT/CC",
      "id": "CERT/CC"
    },
    {
      "text": "REvil",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "REvil",
      "id": "REvil"
    },
    {
      "text": "Sodinokibi",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Sodinokibi",
      "id": "Sodinokibi"
    },
    {
      "text": "NVD",
      "type": "ORG",
      "confidence": 1.0,
      "name": "NVD",
      "id": "NVD"
    },
    {
      "text": "Multiple VPN Applications",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Multiple VPN Applications",
      "id": "Multiple VPN Applications"
    },
    {
      "text": "Pulse Secure VPN\">Multiple Vulnerabilities",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Pulse Secure VPN\">Multiple Vulnerabilities",
      "id": "Pulse Secure VPN\">Multiple Vulnerabilities"
    },
    {
      "text": "Initial Version",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Initial Version",
      "id": "Initial Version"
    },
    {
      "text": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "id": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway"
    },
    {
      "text": "RD",
      "type": "ORG",
      "confidence": 1.0,
      "name": "RD",
      "id": "RD"
    },
    {
      "text": "Elliptic Curve Cryptography",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Elliptic Curve Cryptography",
      "id": "Elliptic Curve Cryptography"
    },
    {
      "text": "detection.</li>\n",
      "type": "ORG",
      "confidence": 1.0,
      "name": "detection.</li>\n",
      "id": "detection.</li>\n"
    },
    {
      "text": "Gateway Server",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Gateway Server",
      "id": "Gateway Server"
    },
    {
      "text": ">Windows RD Gateway Vulnerabilities - CVE-2020-0609/CVE-2020",
      "type": "ORG",
      "confidence": 1.0,
      "name": ">Windows RD Gateway Vulnerabilities - CVE-2020-0609/CVE-2020",
      "id": ">Windows RD Gateway Vulnerabilities - CVE-2020-0609/CVE-2020"
    },
    {
      "text": "li>Occurs",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Occurs",
      "id": "li>Occurs"
    },
    {
      "text": ">Windows Remote Desktop Client Vulnerability - CVE-2020",
      "type": "ORG",
      "confidence": 1.0,
      "name": ">Windows Remote Desktop Client Vulnerability - CVE-2020",
      "id": ">Windows Remote Desktop Client Vulnerability - CVE-2020"
    },
    {
      "text": "Domain Name Server",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Domain Name Server",
      "id": "Domain Name Server"
    },
    {
      "text": "li>Potential",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "li>Potential",
      "id": "li>Potential"
    },
    {
      "text": "href=\"https://csrc.nist.gov",
      "type": "ORG",
      "confidence": 1.0,
      "name": "href=\"https://csrc.nist.gov",
      "id": "href=\"https://csrc.nist.gov"
    },
    {
      "text": "Cyber Essentials",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Cyber Essentials",
      "id": "Cyber Essentials"
    },
    {
      "text": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "id": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s"
    },
    {
      "text": "TLS Callbacks",
      "type": "ORG",
      "confidence": 1.0,
      "name": "TLS Callbacks",
      "id": "TLS Callbacks"
    },
    {
      "text": "Fri",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Fri",
      "id": "Fri"
    },
    {
      "text": "us&#xe2;&#x80;&#xa6",
      "type": "ORG",
      "confidence": 1.0,
      "name": "us&#xe2;&#x80;&#xa6",
      "id": "us&#xe2;&#x80;&#xa6"
    },
    {
      "text": "React2Shell",
      "type": "ORG",
      "confidence": 1.0,
      "name": "React2Shell",
      "id": "React2Shell"
    },
    {
      "text": "today&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "today&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "id": "today&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s"
    },
    {
      "text": "Trump",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Trump",
      "id": "Trump"
    },
    {
      "text": "Kremlin",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Kremlin",
      "id": "Kremlin"
    },
    {
      "text": "Ukraine",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Ukraine",
      "id": "Ukraine"
    },
    {
      "text": "Apple",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Apple",
      "id": "Apple"
    },
    {
      "text": "SMS",
      "type": "ORG",
      "confidence": 1.0,
      "name": "SMS",
      "id": "SMS"
    },
    {
      "text": "BestBuy",
      "type": "ORG",
      "confidence": 1.0,
      "name": "BestBuy",
      "id": "BestBuy"
    },
    {
      "text": "Walmart",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Walmart",
      "id": "Walmart"
    },
    {
      "text": "Netflix",
      "type": "GPE",
      "confidence": 1.0,
      "name": "Netflix",
      "id": "Netflix"
    },
    {
      "text": "ESPN",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ESPN",
      "id": "ESPN"
    },
    {
      "text": "Firefox",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Firefox",
      "id": "Firefox"
    },
    {
      "text": "APT TA423",
      "type": "ORG",
      "confidence": 1.0,
      "name": "APT TA423",
      "id": "APT TA423"
    },
    {
      "text": "ScanBox",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "ScanBox",
      "id": "ScanBox"
    },
    {
      "text": "Conti",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Conti",
      "id": "Conti"
    },
    {
      "text": "CVE",
      "type": "ORG",
      "confidence": 1.0,
      "name": "CVE",
      "id": "CVE"
    },
    {
      "text": "Twitter",
      "type": "PERSON",
      "confidence": 1.0,
      "name": "Twitter",
      "id": "Twitter"
    },
    {
      "text": "Palo Alto Networks",
      "type": "ORG",
      "confidence": 1.0,
      "name": "Palo Alto Networks",
      "id": "Palo Alto Networks"
    },
    {
      "text": "PAN",
      "type": "ORG",
      "confidence": 1.0,
      "name": "PAN",
      "id": "PAN"
    },
    {
      "text": "ASAP",
      "type": "ORG",
      "confidence": 1.0,
      "name": "ASAP",
      "id": "ASAP"
    },
    {
      "text": "WebKit",
      "type": "ORG",
      "confidence": 1.0,
      "name": "WebKit",
      "id": "WebKit"
    }
  ],
  "relationships": [
    {
      "source": "The Department of Homeland Security",
      "target": "Microsoft Office",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "SamSam",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Tor",
      "type": "highlight",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Adobe ColdFusion",
      "type": "highlight",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "the United States",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "li>Windows",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Malware Incident Prevention and Handling for Desktops",
      "target": "Numerous Mimikatz",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "China Chopper",
      "type": "cover",
      "confidence": 0.8
    },
    {
      "source": "li>Maintain",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "New Zealand",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "href=\"https://owasp.org",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Microsoft",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "the Islamic Republic of Iran",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "PowerShell Empire",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "the Windows Remote Desktop Client",
      "type": "present",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Gateway Server",
      "type": "present",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "present",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "PowerShell Empire",
      "type": "make",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "Mimikatz",
      "type": "make",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "a Privileged Access Management (PAM",
      "type": "make",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "establish",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "gain",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "network.</li",
      "type": "detail",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Mozilla",
      "type": "come",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "come",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "Transport Layer Security",
      "type": "detail",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "the Windows Remote Desktop Client",
      "type": "fall",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "China Chopper",
      "type": "pose",
      "confidence": 0.8
    },
    {
      "source": "li>Maintain",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "deploy",
      "confidence": 0.8
    },
    {
      "source": "White House Press Briefing",
      "target": "href=\"https://cloud.google.com",
      "type": "conclude",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Microsoft Security Advisory",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Remote Desktop Protocol",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "stretch",
      "confidence": 0.8
    },
    {
      "source": "Remote Desktop Protocol",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "stretch",
      "confidence": 0.8
    },
    {
      "source": "Remote Desktop Protocol",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "stretch",
      "confidence": 0.8
    },
    {
      "source": "Remote Desktop Protocol",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "stretch",
      "confidence": 0.8
    },
    {
      "source": "Remote Desktop Protocol",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "stretch",
      "confidence": 0.8
    },
    {
      "source": "Local Area Network",
      "target": "PowerShell Empire",
      "type": "allow",
      "confidence": 0.8
    },
    {
      "source": "tran)</strong> - One",
      "target": "href=\"https://cloud.google.com",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "tran)</strong> - One",
      "target": "the House Permanent Select Committee",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Mail Exchanger",
      "target": "DNS Hijacking Campaign",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Upgrade",
      "target": "PowerShell",
      "type": "adapt",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "the Federal Energy Regulatory Commission",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Communications Integration Cell",
      "type": "pose",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "PowerShell",
      "type": "pose",
      "confidence": 0.8
    },
    {
      "source": "Hygiene - Cyber",
      "target": "li>Occurs",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "li>Occurs",
      "target": "the Locky ransomware\">https://blog.avast.com",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "li>Occurs",
      "target": "the Locky ransomware\">https://blog.avast.com",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Credential Guard.</p>\n<p>Credential Guard",
      "target": "the Windows Remote Desktop Client",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "Cyber Security\">10 Steps",
      "target": "Knock Down Dridex Malware",
      "type": "restart",
      "confidence": 0.8
    },
    {
      "source": "Cyber Security\">10 Steps",
      "target": "Earned ‘Evil Corp’ Cybercriminals At Least $50",
      "type": "restart",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "href=\"https://owasp.org",
      "type": "stop",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "Treasury",
      "type": "ensure",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "Domain Name System",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "Local Security Authority Subsystem Service",
      "type": "compromise",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "publish",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": ">Lateral Movement Framework",
      "type": "defend",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "href=\"https://cloud.google.com",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "Microsoft",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "PowerShell Empire",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "the JexBoss Exploit Kit",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell",
      "target": "Cyber Division",
      "type": "upload",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "distance:0",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "PowerShell",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": ">China Chopper",
      "target": "The National Security Agency",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "li>Restrict",
      "target": "href=\"https://docs.microsoft.com",
      "type": "instal",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://nvlpubs.nist.gov",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "PowerShell",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell",
      "target": "New Jersey Cybersecurity &amp",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Advanced Persistent Threat",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "show",
      "confidence": 0.8
    },
    {
      "source": "Advanced Persistent Threat",
      "target": "Mid-2013 - DDoS",
      "type": "show",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Communications Integration Cell",
      "type": "upload",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Microsoft Office",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "href=\"https://owasp.org",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "CVE-2017-3066",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "redirection.</li",
      "type": "relate",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "PowerShell Empire",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "Anti-Virus Software</a>.<br>See",
      "type": "intend",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "Transport Layer Security",
      "type": "place",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "proceed",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "proceed",
      "confidence": 0.8
    },
    {
      "source": "Ransomware</a>.</p",
      "target": "Microsoft Security Advisory",
      "type": "compromise",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "MSIL/Samas",
      "target": "li>Windows",
      "type": "generate",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Verify",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "li>Credential Stealer",
      "target": "Social Engineering",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "target": "a Privileged Access Management (PAM",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "make",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "indicate",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "indicate",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "New Zealand",
      "type": "manage",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Adobe ColdFusion",
      "type": "manage",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the United States",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "network.</li",
      "target": "li>Credential Stealer",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "network.</li",
      "target": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "the United States",
      "type": "log",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "Securing Active",
      "type": "do",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "do",
      "confidence": 0.8
    },
    {
      "source": "li>Defend",
      "target": ">Lateral Movement Framework",
      "type": "intend",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Microsoft Office",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "White House Press Briefing",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The Department of Homeland Security",
      "type": "prompt",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "prompt",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Canada",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "Microsoft",
      "type": "gain",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "PowerShell Empire",
      "type": "undermine",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus Software</a>.<br>See",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus Software</a>.<br>See",
      "target": "HTran",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus Software</a>.<br>See",
      "target": "HTran",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus Software</a>.<br>See",
      "target": "HTran",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus Software</a>.<br>See",
      "target": "PowerShell Empire",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Mozilla",
      "target": "Unified Extensible Firmware Interface",
      "type": "compile",
      "confidence": 0.8
    },
    {
      "source": "Mozilla",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "compile",
      "confidence": 0.8
    },
    {
      "source": "Mozilla",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "compile",
      "confidence": 0.8
    },
    {
      "source": "li>C2 Obfuscation",
      "target": "Transport Layer Security",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "li>C2 Obfuscation",
      "target": "Transport Layer Security",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "li>C2 Obfuscation",
      "target": "the Windows Remote Desktop Client",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "Local Security Authority Subsystem Service",
      "type": "gain",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "gain",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "Security Information and Event Management",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "li>Regularly",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "href=\"https://cloud.google.com",
      "type": "bundle",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "bundle",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "PowerShell Empire",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "PowerShell Empire",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "tran)</strong> - One",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "FBI",
      "target": "the House Permanent Select Committee",
      "type": "perform",
      "confidence": 0.8
    },
    {
      "source": "FBI",
      "target": "PowerShell Empire",
      "type": "perform",
      "confidence": 0.8
    },
    {
      "source": "DNS Hijacking Campaign",
      "target": "the Islamic Revolutionary Guard Corps",
      "type": "automate",
      "confidence": 0.8
    },
    {
      "source": "the Mabna Institute",
      "target": "Cybersecurity Advisory on Pulse Secure",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Mabna Institute",
      "target": "Financial",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "CERT/CC Vulnerability Note",
      "target": "the Microsoft Security Advisory",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "CERT/CC Vulnerability Note",
      "target": "href=\"https://nvlpubs.nist.gov",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "the United Nations Children’s Fund",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "New Jersey Cybersecurity &amp",
      "type": "identify",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Communications Integration Cell",
      "type": "identify",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Mimikatz",
      "type": "identify",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Windows Remote Desktop Gateway",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Mathieu Geli\">Comae Technologies:",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Locky Ransomware\">https://www.alertlogic.com/resources",
      "target": "the Antimalware Scan Interface",
      "type": "offer",
      "confidence": 0.8
    },
    {
      "source": "Locky Ransomware\">https://www.alertlogic.com/resources",
      "target": "the Antimalware Scan Interface",
      "type": "offer",
      "confidence": 0.8
    },
    {
      "source": "Locky Ransomware\">https://www.alertlogic.com/resources",
      "target": "the Antimalware Scan Interface",
      "type": "offer",
      "confidence": 0.8
    },
    {
      "source": "li>Windows: Monitor",
      "target": "href=\"https://blog.avast.com",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Windows Registry",
      "target": "Microsoft",
      "type": "meet",
      "confidence": 0.8
    },
    {
      "source": "Windows Registry",
      "target": "li>Set PowerShell",
      "type": "meet",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "set",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "discourage",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "allow",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "href=\"https://github.com",
      "type": "allow",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Transport Layer Security",
      "type": "help",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Transport Layer Security",
      "type": "help",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "China Chopper",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "Microsoft Windows Clients",
      "type": "circumvent",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Microsoft Security Advisory",
      "type": "perform",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "Local Area Network",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "PowerShell Empire",
      "type": "apply",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Microsoft",
      "type": "apply",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Microsoft",
      "type": "apply",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Operating Systems",
      "target": "China Chopper",
      "type": "log",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "move",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Local Administrator Password Solution",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Local Administrator Password Solution",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "Anti-Virus Software</a>.<br>See",
      "type": "design",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "Anti-Virus Software</a>.<br>See",
      "type": "design",
      "confidence": 0.8
    },
    {
      "source": "Unified Extensible Firmware Interface",
      "target": "li>Credential Stealer",
      "type": "gain",
      "confidence": 0.8
    },
    {
      "source": "Unified Extensible Firmware Interface",
      "target": "Active Directory",
      "type": "gain",
      "confidence": 0.8
    },
    {
      "source": "SamSam",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "SamSam",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "li>C2 Obfuscation",
      "type": "escalate",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "Multi-Factor Authentication",
      "type": "escalate",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "Transport Layer Security",
      "type": "escalate",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "build",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "a Privileged Access Management (PAM",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "li>Defend",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": ">Lateral Movement Framework",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "Social Security Numbers",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Wherever Mimikatz",
      "target": "PowerShell Empire",
      "type": "configure",
      "confidence": 0.8
    },
    {
      "source": "Wherever Mimikatz",
      "target": "Microsoft Security Advisory",
      "type": "configure",
      "confidence": 0.8
    },
    {
      "source": "Wherever Mimikatz",
      "target": "PowerShell",
      "type": "configure",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "the Islamic Revolutionary Guard Corps",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Microsoft End of Support FAQ</a></div",
      "target": "li>Crowdstrike",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "Pulse Secure VPN\">Multiple Vulnerabilities",
      "target": "Pulse Secure",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The Department of Homeland Security",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Local Administrator Password Solution",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the United Kingdom",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "Adobe ColdFusion",
      "type": "move",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "evade",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Anti-Virus Software</a>.<br>See",
      "type": "choice",
      "confidence": 0.8
    },
    {
      "source": "Operation for Community Development and Empowerment",
      "target": "Special Publication",
      "type": "detect",
      "confidence": 0.8
    },
    {
      "source": "Special Publication",
      "target": "Securing Active",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "PowerShell Empire",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Microsoft",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Microsoft",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "White House Press Briefing",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "Bloomberg",
      "type": "encode",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "JBoss",
      "type": "encode",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "JBoss",
      "type": "encode",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "JBoss",
      "type": "encode",
      "confidence": 0.8
    },
    {
      "source": "files.&nbsp",
      "target": "Ransomware</a>.</p",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "li>Establish",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "embed",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "SAP Exploit",
      "type": "generate",
      "confidence": 0.8
    },
    {
      "source": "Microsoft End of Support FAQ</a></div",
      "target": "the U.S. Justice Department",
      "type": "block",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "Advanced Persistent Threat",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "PowerShell",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the State of Indiana",
      "target": "the United Nations Children’s Fund",
      "type": "add",
      "confidence": 0.8
    },
    {
      "source": "Malware",
      "target": "the U.S. Department of Justice",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "PowerShell Empire",
      "type": "facilitate",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "Mimikatz",
      "type": "facilitate",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "facilitate",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "href=\"https://github.com",
      "type": "control",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus",
      "target": "HTran",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "China",
      "target": "Active Directory",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "China",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "China",
      "target": "China Chopper",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "Microsoft",
      "target": "PowerShell Empire",
      "type": "forward",
      "confidence": 0.8
    },
    {
      "source": "Microsoft",
      "target": "href=\"https://support.microsoft.com",
      "type": "forward",
      "confidence": 0.8
    },
    {
      "source": "DNS Hijacking Campaign",
      "target": "Mail Exchanger",
      "type": "inject",
      "confidence": 0.8
    },
    {
      "source": "DNS Hijacking Campaign",
      "target": "Mail Exchanger",
      "type": "inject",
      "confidence": 0.8
    },
    {
      "source": "DNS Hijacking Campaign",
      "target": "Mail Exchanger",
      "type": "inject",
      "confidence": 0.8
    },
    {
      "source": "DNS Hijacking Campaign",
      "target": "PowerShell Empire",
      "type": "inject",
      "confidence": 0.8
    },
    {
      "source": "DNS Hijacking Campaign",
      "target": "the Islamic Revolutionary Guard Corps",
      "type": "inject",
      "confidence": 0.8
    },
    {
      "source": "HTran",
      "target": "The National Security Agency",
      "type": "maintain",
      "confidence": 0.8
    },
    {
      "source": "HTran",
      "target": "China Chopper",
      "type": "maintain",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Upgrade",
      "target": "CERT/CC Vulnerability Note",
      "type": "compromise",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Upgrade",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "compromise",
      "confidence": 0.8
    },
    {
      "source": "Advanced Persistent Threat",
      "target": "PowerShell",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office 365 Security",
      "target": ">Additional Resources",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": ">Additional Resources",
      "target": "href=\"https://reliaquest.com/blog",
      "type": "start",
      "confidence": 0.8
    },
    {
      "source": ">Additional Resources",
      "target": "href=\"https://reliaquest.com/blog",
      "type": "start",
      "confidence": 0.8
    },
    {
      "source": "Locky Ransomware\">https://www.alertlogic.com/resources",
      "target": "the Antimalware Scan Interface",
      "type": "apply",
      "confidence": 0.8
    },
    {
      "source": "Transmission Control Protocol",
      "target": "Society for Worldwide Interbank Financial Telecommunication",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "Society for Worldwide Interbank Financial Telecommunication",
      "target": ">Windows Remote Desktop Client Vulnerability - CVE-2020",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Credential Guard.</p>\n<p>Credential Guard",
      "target": "li>Brewster",
      "type": "generate",
      "confidence": 0.8
    },
    {
      "source": "li>Brewster",
      "target": "the Windows Remote Desktop Client",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "National Cyber Security Centre",
      "target": "Software",
      "type": "title=\"understande",
      "confidence": 0.8
    },
    {
      "source": "redirection.</li",
      "target": "href=\"https://github.com",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "the Islamic Republic of Iran",
      "type": "move",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "PowerShell Empire",
      "type": "move",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "title=\"protecte",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "move",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "href=\"https://support.microsoft.com",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "the JexBoss Exploit Kit",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "the JexBoss Exploit Kit",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "Ransomware</a>.</p",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "Frutas",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "href=\"https://cloud.google.com",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "the House Permanent Select Committee",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "Ransomware</a>.</p",
      "target": "li>Establish",
      "type": "title=\"prevente",
      "confidence": 0.8
    },
    {
      "source": "Visual Basic",
      "target": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Visual Basic",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Visual Basic",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Visual Basic",
      "target": "White House Press Briefing",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Visual Basic",
      "target": "Microsoft",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "benefit",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://owasp.org",
      "target": "the United Kingdom",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "Anti-Virus",
      "type": "title=\"understande",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "Microsoft Office",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "reach",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "cut",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "China Chopper",
      "type": "cut",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "The National Cybersecurity and Communications Integration Center",
      "type": "feel",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "redirection.</li",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "href=\"https://github.com",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "li>Windows",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Social Engineering",
      "type": "title=\"avoide",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "title=\"avoide",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "title=\"avoide",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Message Servers",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "a Privileged Access Management (PAM",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "a Privileged Access Management (PAM",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "a Privileged Access Management (PAM",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Microsoft Windows Clients",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the JexBoss Exploit Kit",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "DNS Hijacking Campaign",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "the Islamic Revolutionary Guard Corps",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "the House Permanent Select Committee",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://support.microsoft.com",
      "target": "The National Security Agency",
      "type": "back",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "Microsoft",
      "type": "handle",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "redirection.</li",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "MSIL/Samas",
      "type": "know",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "Anti-Virus",
      "type": "share",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "share",
      "confidence": 0.8
    },
    {
      "source": "li>Webshell",
      "target": "Active Directory",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "li>Webshell",
      "target": "li>Credential Stealer",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "target": "li>C2 Obfuscation",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the United States",
      "type": "locate",
      "confidence": 0.8
    },
    {
      "source": "Malware Incident Prevention and Handling for Desktops",
      "target": "Local Security Authority Subsystem Service",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "a Privileged Access Management (PAM",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "a Privileged Access Management (PAM",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "resume",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "Microsoft Office",
      "type": "exploit",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://support.microsoft.com",
      "target": "the JexBoss Exploit Kit",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Security Advisory",
      "target": "Remote Desktop Protocol",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "New Zealand",
      "type": "enter",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Adobe ColdFusion",
      "type": "escalate",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "the Islamic Republic of Iran",
      "type": "escalate",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "PowerShell Empire",
      "type": "escalate",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "li>Webshell",
      "type": "complete",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>C2 Obfuscation",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>C2 Obfuscation",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>C2 Obfuscation",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "China Chopper",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Operation for Community Development and Empowerment",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "Message Servers",
      "target": "Transport Layer Security",
      "type": "find",
      "confidence": 0.8
    },
    {
      "source": "Securing Active",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "purchase",
      "confidence": 0.8
    },
    {
      "source": "Securing Active",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "purchase",
      "confidence": 0.8
    },
    {
      "source": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "target": "PowerShell Empire",
      "type": "infect",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "Microsoft",
      "type": "find",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "Microsoft Office",
      "type": "sell",
      "confidence": 0.8
    },
    {
      "source": "Cobalt Strike",
      "target": "New Zealand",
      "type": "leave",
      "confidence": 0.8
    },
    {
      "source": "Cobalt Strike",
      "target": "CVE-2017-3066",
      "type": "leave",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Active Directory",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "Transport Layer Security",
      "type": "represent",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Securing Active",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Numerous Mimikatz",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "href=\"https://cloud.google.com",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "href=\"https://cloud.google.com",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Social Security Numbers",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The Department of Homeland Security",
      "type": "review",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The National Cybersecurity and Communications Integration Center",
      "type": "review",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "New Zealand",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "the Federal Bureau of Investigation (FBI",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Ransomware</a>.</p",
      "target": "Microsoft Security Advisory",
      "type": "follow",
      "confidence": 0.8
    },
    {
      "source": "Ransomware</a>.</p",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "follow",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "the U.S. Department of Justice",
      "type": "match",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Active Directory",
      "type": "match",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "Special Publication",
      "type": "find",
      "confidence": 0.8
    },
    {
      "source": "the U.S. Justice Department",
      "target": "PowerShell",
      "type": "help",
      "confidence": 0.8
    },
    {
      "source": "the U.S. Justice Department",
      "target": "Migration Considerations</a></div>\n",
      "type": "help",
      "confidence": 0.8
    },
    {
      "source": "the U.S. Justice Department",
      "target": "Migration Considerations</a></div>\n",
      "type": "help",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "CVE-2017-3066",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "the United States",
      "type": "resolve",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus Software</a>.<br>See",
      "target": ">Lateral Movement Framework",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Malware Incident Prevention and Handling for Desktops",
      "target": "China Chopper",
      "type": "list",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "li>Search",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "li>Next",
      "target": "Address",
      "type": "alter",
      "confidence": 0.8
    },
    {
      "source": "Mail Exchanger",
      "target": "PowerShell Empire",
      "type": "replace",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "direct",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "the United Kingdom",
      "type": "create",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "Microsoft Office",
      "type": "persist",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "href=\"https://github.com",
      "type": "persist",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "the United States",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "HTran",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "Unified Extensible Firmware Interface",
      "target": "li>Credential Stealer",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Unified Extensible Firmware Interface",
      "target": "Social Engineering",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "li>Windows",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Ransomware</a>.</p",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the Windows Remote Desktop Client",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "change",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "li>Search",
      "type": "resolve",
      "confidence": 0.8
    },
    {
      "source": "Cloud Blog</a></li>",
      "target": "Invoke-Mimikatz",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Cloud Blog</a></li>",
      "target": "The National Security Agency",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Cloud Blog</a></li>",
      "target": "li>Make",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Cloud Blog</a></li>",
      "target": "PowerShell",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Cloud Blog</a></li>",
      "target": "href=\"https://nvlpubs.nist.gov",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Cloud Blog</a></li>",
      "target": "href=\"https://nvlpubs.nist.gov",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the United States",
      "type": "describe",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "describe",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": ">Lateral Movement Framework",
      "type": "detail",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": ">Lateral Movement Framework",
      "type": "detail",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "Microsoft Office",
      "type": "detail",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "White House Press Briefing",
      "type": "detail",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "White House Press Briefing",
      "type": "expose",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "allow",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "Microsoft Windows Clients",
      "type": "communicate",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "Sanctions Evil Corp",
      "type": "detect",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "href=\"https://cloud.google.com",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The National Cybersecurity and Communications Integration Center",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "New Zealand",
      "type": "access",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "United",
      "type": "act",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "result",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "expose",
      "confidence": 0.8
    },
    {
      "source": "li>Verify",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "act",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "China Chopper",
      "type": "listen",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Transport Layer Security",
      "type": "listen",
      "confidence": 0.8
    },
    {
      "source": "Securing Active",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "access",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "gain",
      "confidence": 0.8
    },
    {
      "source": "li>Maintain",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "reach",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "li>Search",
      "type": "expose",
      "confidence": 0.8
    },
    {
      "source": "White House Press Briefing",
      "target": "href=\"https://cloud.google.com",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "White House Press Briefing",
      "target": "href=\"https://cloud.google.com",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "White House Press Briefing",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "the JexBoss Exploit Kit",
      "type": "work",
      "confidence": 0.8
    },
    {
      "source": "distance:0",
      "target": "Microsoft End of Support FAQ</a></div",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "distance:0",
      "target": "WannaCry",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "the U.S. Justice Department",
      "target": "href=\"https://support.microsoft.com",
      "type": "mitigate",
      "confidence": 0.8
    },
    {
      "source": "the Microsoft Security Advisory",
      "target": "href=\"https://nvlpubs.nist.gov",
      "type": "authorize",
      "confidence": 0.8
    },
    {
      "source": "the Microsoft Security Advisory",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "authorize",
      "confidence": 0.8
    },
    {
      "source": "the Microsoft Security Advisory",
      "target": "Gateways",
      "type": "authorize",
      "confidence": 0.8
    },
    {
      "source": "the Microsoft Security Advisory",
      "target": "Migration Considerations</a></div>\n",
      "type": "authorize",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "Securing Active",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "CVE-2017-3066",
      "type": "know",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "exist",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "BitPaymer",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "li>Regularly",
      "target": "a Privileged Access Management (PAM",
      "type": "exploit",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "the United States",
      "type": "send",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "Mimikatz",
      "type": "send",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Security Advisory",
      "target": "li>Establish",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "li>Establish",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "perform",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "tran)</strong> - One",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "Cybersecurity Advisory on Pulse Secure",
      "target": "Pulse Secure VPN\">Multiple Vulnerabilities",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Cybersecurity Advisory on Pulse Secure",
      "target": "China Chopper",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Cybersecurity Advisory on Pulse Secure",
      "target": "China Chopper",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "CERT/CC Vulnerability Note",
      "target": "href=\"https://docs.microsoft.com",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "CERT/CC Vulnerability Note",
      "target": "href=\"https://nvlpubs.nist.gov",
      "type": "review",
      "confidence": 0.8
    },
    {
      "source": "Microsoft",
      "target": "Communications Integration Cell",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "Mathieu Geli\">Comae Technologies:",
      "target": "Community Development and Empowerment",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Microsoft",
      "type": "support",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "li>Avast Blog",
      "type": "support",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Active Directory",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Unified Extensible Firmware Interface",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "li>Credential Stealer",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "SamSam Malware Analysis Reports",
      "type": "prevent",
      "confidence": 0.8
    },
    {
      "source": "Special Publication",
      "target": "Securing Active",
      "type": "block",
      "confidence": 0.8
    },
    {
      "source": "Special Publication",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "block",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "apply",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Visual Basic",
      "type": "update",
      "confidence": 0.8
    },
    {
      "source": "Social Engineering",
      "target": "Unified Extensible Firmware Interface",
      "type": "end",
      "confidence": 0.8
    },
    {
      "source": "Social Engineering",
      "target": "li>Windows",
      "type": "end",
      "confidence": 0.8
    },
    {
      "source": "li>C2 Obfuscation",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "operate",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "receive",
      "confidence": 0.8
    },
    {
      "source": "BitPaymer",
      "target": "li>Regularly",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "The Cybersecurity and Infrastructure Security Agency",
      "target": "White House Press Briefing",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "refer",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "Microsoft Office",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "Unified Extensible Firmware Interface",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "Malware Incident Prevention and Handling for Desktops",
      "target": "Numerous Mimikatz",
      "type": "support",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "China Chopper",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "Numerous Mimikatz",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "Malware Incident Prevention and Handling for Desktops",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "experience",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "result",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "Mimikatz",
      "type": "result",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Mimikatz",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Linux",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "PowerShell Empire",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "SAP Gateway",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "Mimikatz",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "Mimikatz",
      "type": "encourage",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "Remote Desktop Services",
      "type": "migrate",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Security Advisory",
      "target": "the House Permanent Select Committee",
      "type": "explore",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "the Federal Energy Regulatory Commission",
      "type": "leave",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "The National Cybersecurity and Communications Integration Center",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Treasury",
      "target": "li>Windows",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "li>Credential Stealer",
      "target": "Active Directory",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "li>Credential Stealer",
      "target": "Mimikatz",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "li>Credential Stealer",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Malware Incident Prevention and Handling for Desktops",
      "target": "Numerous Mimikatz",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Malware Incident Prevention and Handling for Desktops",
      "target": "China Chopper",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "contain",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "Elliptic Curve Cryptography",
      "type": "incorporate",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "incorporate",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "href=\"https://cloud.google.com",
      "type": "incorporate",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "PowerShell",
      "type": "charge",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "Microsoft Windows Upgrade",
      "type": "charge",
      "confidence": 0.8
    },
    {
      "source": "li>Restrict",
      "target": "Advanced Persistent Threat",
      "type": "introduce",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "involve",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Local Administrator Password Solution",
      "type": "relate",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "Local Security Authority Subsystem Service",
      "type": "impact",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "impact",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "impact",
      "confidence": 0.8
    },
    {
      "source": "Elliptic Curve Cryptography",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Elliptic Curve Cryptography",
      "target": "White House Press Briefing",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Elliptic Curve Cryptography",
      "target": "li>Defend",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "li>Defend",
      "target": "Ransomware</a>.</p",
      "type": "distribute",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "Australia",
      "type": "persuade",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "PowerShell Empire",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Microsoft Office",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Microsoft Office",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Visual Basic",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Windows",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Unified Extensible Firmware Interface",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Credential Stealer",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Special Publication",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "the United Kingdom",
      "type": "vary",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "redirection.</li",
      "type": "vary",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "href=\"https://github.com",
      "type": "vary",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "Microsoft Windows Operating Systems",
      "type": "vary",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "HTran",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Windows",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "PowerShell Empire",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "li>Credential Stealer",
      "target": "Active Directory",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "target": "China Chopper",
      "type": "generate",
      "confidence": 0.8
    },
    {
      "source": "Operation for Community Development and Empowerment",
      "target": "Transport Layer Security",
      "type": "represent",
      "confidence": 0.8
    },
    {
      "source": "Operation for Community Development and Empowerment",
      "target": "Local Security Authority Subsystem Service",
      "type": "represent",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "Security Information and Event Management",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "PowerShell Empire",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "Australia",
      "type": "take",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "Local Administrator Password Solution",
      "type": "take",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "href=\"https://owasp.org",
      "type": "conceal",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "redirection.</li",
      "type": "conceal",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "PowerShell Empire",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Microsoft Office",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Transport Layer Security",
      "type": "contain",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Special Publication",
      "type": "reach",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "reach",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "reach",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Numerous Mimikatz",
      "type": "reach",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "a Privileged Access Management (PAM",
      "type": "launch",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "a Privileged Access Management (PAM",
      "type": "launch",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "extract",
      "confidence": 0.8
    },
    {
      "source": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "target": "PowerShell Empire",
      "type": "imbed",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "contain",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "target": "redirection.</li",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "redirection.</li",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "redirection.</li",
      "target": "the Islamic Republic of Iran",
      "type": "enable",
      "confidence": 0.8
    },
    {
      "source": "Visual Basic",
      "target": "li>Windows",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "China Chopper",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Message Servers",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Special Publication",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "the United States",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Transport Layer Security",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "White House Press Briefing",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "White House Press Briefing",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "White House Press Briefing",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "White House Press Briefing",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "White House Press Briefing",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "PowerShell Empire",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Security Advisory",
      "target": "Remote Desktop Protocol",
      "type": "infiltrate",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Security Advisory",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "detect",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Security Advisory",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "detect",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Cybersecurity Advisory on Pulse Secure",
      "type": "involve",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Cybersecurity Advisory on Pulse Secure",
      "type": "involve",
      "confidence": 0.8
    },
    {
      "source": "Migration Considerations</a></div>\n",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "continue",
      "confidence": 0.8
    },
    {
      "source": "Dridex",
      "target": "the United Nations Children’s Fund",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "clients.</li",
      "target": ">Additional Resources",
      "type": "share",
      "confidence": 0.8
    },
    {
      "source": ">Windows RD Gateway Vulnerabilities - CVE-2020-0609/CVE-2020",
      "target": "Friedex",
      "type": "know",
      "confidence": 0.8
    },
    {
      "source": ">Windows RD Gateway Vulnerabilities - CVE-2020-0609/CVE-2020",
      "target": "Dridex",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "Community Development and Empowerment",
      "target": "target=\"_blank",
      "type": "compile",
      "confidence": 0.8
    },
    {
      "source": "Locky Ransomware",
      "target": "li>Canadian Centre",
      "type": "distribute",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "result",
      "confidence": 0.8
    },
    {
      "source": "CVE-2017-3066",
      "target": "Microsoft Office",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "PowerShell Empire",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "Osiris",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "detection.</li>\n",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "detection.</li>\n",
      "target": "PowerShell Empire",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Active Directory",
      "type": "depend",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "li>C2 Obfuscation",
      "type": "take",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "China Chopper",
      "type": "take",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "TA505",
      "type": "know",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "Mimikatz",
      "type": "refer",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "White House Press Briefing",
      "type": "refer",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "refer",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "distribute",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "PowerShell Empire",
      "type": "distribute",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "the Islamic Republic of Iran",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Windows",
      "type": "study",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "JavaScript",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "li>Credential Stealer",
      "target": "Active Directory",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Securing Active",
      "target": "the United States",
      "type": "operate",
      "confidence": 0.8
    },
    {
      "source": "Securing Active",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "operate",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "base",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The Department of Homeland Security",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "The Department of Homeland Security",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "assure",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "redirection.</li",
      "target": "href=\"https://github.com",
      "type": "ensure",
      "confidence": 0.8
    },
    {
      "source": "redirection.</li",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "ensure",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "li>Verify",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "CVE-2020-0611",
      "target": "li>Webshell",
      "type": "encrypt",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "The United Kingdom National Cyber Security Centre",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Local Security Authority Subsystem Service",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Special Publication",
      "target": "the United States",
      "type": "take",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Securing Active",
      "type": "increase",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "increase",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "protect",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "Microsoft Office",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "Visual Basic",
      "type": "base",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "li>Credential Stealer",
      "type": "decrease",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "Active Directory",
      "type": "decrease",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "type": "decrease",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "SamSam Malware Analysis Reports",
      "type": "hide",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "assist",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "assist",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "Windows CryptoAPI,&nbsp;Windows Remote Desktop Gateway",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "the Federal Energy Regulatory Commission",
      "type": "represent",
      "confidence": 0.8
    },
    {
      "source": "Guide to Malware Incident Prevention and Handling for Desktops",
      "target": "the Federal Energy Regulatory Commission",
      "type": "represent",
      "confidence": 0.8
    },
    {
      "source": "li>Remove",
      "target": "Community Development and Empowerment",
      "type": "access",
      "confidence": 0.8
    },
    {
      "source": "FBI",
      "target": "li>Set PowerShell",
      "type": "announce",
      "confidence": 0.8
    },
    {
      "source": "Dridex",
      "target": "PowerShell",
      "type": "access",
      "confidence": 0.8
    },
    {
      "source": "Dridex",
      "target": "li>Geoff White",
      "type": "access",
      "confidence": 0.8
    },
    {
      "source": "National Cyber Security Centre",
      "target": "Software",
      "type": "push",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "Deobfuscate/Decode Files or Information",
      "type": "ransomware",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "href=\"https://owasp.org",
      "type": "ransomware",
      "confidence": 0.8
    },
    {
      "source": "BitPaymer",
      "target": "Dridex",
      "type": "ransomware",
      "confidence": 0.8
    },
    {
      "source": "Intelligence Blog",
      "target": "the NIST Cybersecurity Framework",
      "type": "link",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "Microsoft Office",
      "type": "retaliate",
      "confidence": 0.8
    },
    {
      "source": "The Cybersecurity and Infrastructure Security Agency",
      "target": "href=\"https://cloud.google.com",
      "type": "report",
      "confidence": 0.8
    },
    {
      "source": "The Cybersecurity and Infrastructure Security Agency",
      "target": "href=\"https://cloud.google.com",
      "type": "report",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The National Cybersecurity and Communications Integration Center",
      "type": "depend",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus Software</a>.<br>See",
      "target": "the U.S. Department of Justice",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "CVE-2020-0610",
      "type": "know",
      "confidence": 0.8
    },
    {
      "source": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "target": "Microsoft Security Advisory",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "target": "a Privileged Access Management (PAM",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "a Privileged Access Management (PAM",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "exercise",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "the JexBoss Exploit Kit",
      "type": "improve",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "Hypertext Preprocessor",
      "type": "demonstrate",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "href=\"https://cloud.google.com",
      "type": "include",
      "confidence": 0.8
    },
    {
      "source": "Pulse Secure VPN\">Multiple Vulnerabilities",
      "target": "CERT/CC Vulnerability Note",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "the U.S. Department of Justice",
      "target": "the United Nations Children’s Fund",
      "type": "indict",
      "confidence": 0.8
    },
    {
      "source": "the U.S. Department of Justice",
      "target": ">Additional Resources",
      "type": "indict",
      "confidence": 0.8
    },
    {
      "source": ">Additional Resources",
      "target": "href=\"https://reliaquest.com/blog",
      "type": "employ",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Clients",
      "target": "U.S.",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "prevent",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "li>Windows",
      "type": "indict",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Active Directory",
      "type": "indict",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "obtain",
      "confidence": 0.8
    },
    {
      "source": ">Lateral Movement Framework",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "hack",
      "confidence": 0.8
    },
    {
      "source": "PowerShell",
      "target": "Ransomware</a>.</p",
      "type": "wipe",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "li>Minimize",
      "type": "identify",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "Microsoft End of Support FAQ</a></div",
      "type": "identify",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://support.microsoft.com",
      "target": "The National Security Agency",
      "type": "indict",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "the Mabna Institute",
      "type": "associate",
      "confidence": 0.8
    },
    {
      "source": "Pulse Secure VPN\">Multiple Vulnerabilities",
      "target": "CERT/CC Vulnerability Note",
      "type": "contain",
      "confidence": 0.8
    },
    {
      "source": "Crowdstrike",
      "target": "href=\"https://msrc.microsoft.com",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "Crowdstrike",
      "target": "Microsoft Windows Upgrade",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "New Jersey Cybersecurity &amp",
      "target": "href=\"https://github.com",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "New Jersey Cybersecurity &amp",
      "target": ">Windows RD Gateway Vulnerabilities - CVE-2020-0609/CVE-2020",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Local Administrator Password Solution",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "href=\"https://owasp.org",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the United Kingdom",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "href=\"https://github.com",
      "type": "recommend",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "a Privileged Access Management (PAM",
      "type": "face",
      "confidence": 0.8
    },
    {
      "source": "li>Defend",
      "target": ">Lateral Movement Framework",
      "type": "allow",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://support.microsoft.com",
      "target": "SAP Gateway",
      "type": "need",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "DNSpionage Campaign Targets Middle East</a></li>",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Word",
      "target": "PowerShell Empire",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": ">Additional Resources",
      "target": "Microsoft Windows Clients",
      "type": "overlap",
      "confidence": 0.8
    },
    {
      "source": ">Additional Resources",
      "target": "Microsoft Windows Clients",
      "type": "overlap",
      "confidence": 0.8
    },
    {
      "source": "Communications Integration Cell",
      "target": ">Windows RD Gateway Vulnerabilities - CVE-2020-0609/CVE-2020",
      "type": "interact",
      "confidence": 0.8
    },
    {
      "source": "Communications Integration Cell",
      "target": "PowerShell",
      "type": "interact",
      "confidence": 0.8
    },
    {
      "source": "Communications Integration Cell",
      "target": "PowerShell",
      "type": "interact",
      "confidence": 0.8
    },
    {
      "source": "Communications Integration Cell",
      "target": "li>Linux",
      "type": "interact",
      "confidence": 0.8
    },
    {
      "source": "Gateway Access Control Lists",
      "target": "Files",
      "type": "title=\"obfuscate",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blog.avast.com",
      "target": "PowerShell",
      "type": "interact",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blog.avast.com",
      "target": "li>Linux",
      "type": "interact",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "open",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "open",
      "confidence": 0.8
    },
    {
      "source": "Kingdom National Cyber Security Centre\">UK",
      "target": "National Cyber Security Centre",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "href=\"https://owasp.org",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Active Directory",
      "target": "Deobfuscate/Decode Files or Information",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "li>Anti-virus",
      "target": "href=\"https://www.welivesecurity.com/2018/01/26",
      "type": "detect",
      "confidence": 0.8
    },
    {
      "source": "https://blogs.forcepoint.com/blog/security-labs/new-year-new-look-dridex-compromised-ftp",
      "target": "li>Sanghavi",
      "type": "mitigate",
      "confidence": 0.8
    },
    {
      "source": "BitPaymer Gangs Linked",
      "target": "the NIST Cybersecurity Framework",
      "type": "lead",
      "confidence": 0.8
    },
    {
      "source": "Local Administrator Password Solution",
      "target": "Microsoft",
      "type": "apply",
      "confidence": 0.8
    },
    {
      "source": "Domain Name System",
      "target": "Microsoft Windows Operating Systems",
      "type": "read",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Operating Systems",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "know",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Windows Operating Systems",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "know",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "become",
      "confidence": 0.8
    },
    {
      "source": "Elliptic Curve Cryptography",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "exploit",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "Local Area Network",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "Hypertext Preprocessor",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "SAP Exploit",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "SAP Exploit",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "DNSpionage Campaign Targets Middle East</a></li>",
      "target": "SAP Exploit",
      "type": "get",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "PowerShell",
      "type": "produce",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Cybersecurity Advisory on Pulse Secure",
      "type": "produce",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Pulse Secure",
      "type": "produce",
      "confidence": 0.8
    },
    {
      "source": "PowerShell",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "contain",
      "confidence": 0.8
    },
    {
      "source": "DigiNotar",
      "target": "Advanced Persistent Threat",
      "type": "report",
      "confidence": 0.8
    },
    {
      "source": "Advanced Persistent Threat",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "target",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "Adobe ColdFusion",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "Microsoft Office",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "Microsoft Advanced Threat Analytics",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "PowerShell Empire",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "the United States",
      "type": "execute",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "Anti-Virus",
      "type": "execute",
      "confidence": 0.8
    },
    {
      "source": "li>Windows",
      "target": "Microsoft Office",
      "type": "connect",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "White House Press Briefing",
      "type": "urge",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "urge",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "PowerShell Empire",
      "type": "urge",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "href=\"https://support.microsoft.com",
      "type": "urge",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "Local Administrator Password Solution",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Federal Bureau of Investigation (FBI",
      "target": "United",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Federal Bureau of Investigation (FBI",
      "target": "li>Scan",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "the United States",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Windows",
      "type": "release",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "exploit",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "exploit",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "exploit",
      "confidence": 0.8
    },
    {
      "source": "the Windows Remote Desktop Client",
      "target": "Numerous Mimikatz",
      "type": "exploit",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "a Privileged Access Management (PAM",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://msrc.microsoft.com",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "deceive",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "Canada",
      "target": "the United Kingdom",
      "type": "authorize",
      "confidence": 0.8
    },
    {
      "source": "Microsoft",
      "target": "Domain Name System",
      "type": "rely",
      "confidence": 0.8
    },
    {
      "source": "CVE-2017-3066",
      "target": "href=\"https://github.com",
      "type": "issue",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Advanced Threat Analytics",
      "target": "li>C2 Obfuscation",
      "type": "affect",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "allow",
      "confidence": 0.8
    },
    {
      "source": "The United Kingdom National Cyber Security Centre",
      "target": "the National Institute of Standards and Technology.[<a href=\"https://nvlpubs.nist.gov",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The Cybersecurity and Infrastructure Security Agency",
      "target": "White House Press Briefing",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The Cybersecurity and Infrastructure Security Agency",
      "target": "The Cybersecurity and Infrastructure Security Agency",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Credential Stealer",
      "type": "prioritize",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "li>Windows",
      "type": "prioritize",
      "confidence": 0.8
    },
    {
      "source": "Special Publication",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "validate",
      "confidence": 0.8
    },
    {
      "source": "China Chopper",
      "target": "a Privileged Access Management (PAM",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "li>Defend",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "PowerShell Empire",
      "type": "conduct",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://cloud.google.com",
      "target": "the JexBoss Exploit Kit",
      "type": "conduct",
      "confidence": 0.8
    },
    {
      "source": "DNS Hijacking Campaign",
      "target": "PowerShell Empire",
      "type": "rely",
      "confidence": 0.8
    },
    {
      "source": "Multiple VPN Applications",
      "target": "Microsoft End of Support FAQ</a></div",
      "type": "impersonate",
      "confidence": 0.8
    },
    {
      "source": "li>Crowdstrike",
      "target": "the U.S. Justice Department",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "li>Crowdstrike",
      "target": "PowerShell",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": ">China Chopper",
      "target": "The National Security Agency",
      "type": "bypass",
      "confidence": 0.8
    },
    {
      "source": "the Mabna Institute",
      "target": "Cybersecurity Advisory on Pulse Secure",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "the Mabna Institute",
      "target": "li>Restrict",
      "type": "run",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://nvlpubs.nist.gov",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "address",
      "confidence": 0.8
    },
    {
      "source": "Dridex Malware",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "validate",
      "confidence": 0.8
    },
    {
      "source": "Dridex Malware",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "validate",
      "confidence": 0.8
    },
    {
      "source": "Message Server",
      "target": "the State of Indiana",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Message Server",
      "target": "the United Nations",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Message Server",
      "target": "BadRabbit",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Message Server",
      "target": "href=\"https://reliaquest.com/blog",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Communications Integration Cell",
      "target": "Windows Remote Desktop Gateway",
      "type": "exist",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "Community Development and Empowerment",
      "type": "connect",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "the Locky ransomware\">https://blog.avast.com",
      "target": "href=\"https://support.microsoft.com",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "PHP",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "explain",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus",
      "target": "the U.S. Department of Justice",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "the United States",
      "target": "Malware Incident Prevention and Handling for Desktops",
      "type": "provide",
      "confidence": 0.8
    },
    {
      "source": "Security Information and Event Management",
      "target": "SamSam",
      "type": "implement",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "Adobe ColdFusion",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "the Islamic Republic of Iran",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://blogs.microsoft.com",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Social Engineering",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "FinCEN",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Cybersecurity Advisory on Pulse Secure",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Migration Considerations</a></div>\n",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "PowerShell",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "PowerShell",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "PowerShell",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Migration Considerations</a></div>\n",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The National Security Agency",
      "target": "Guide to Malware Incident Prevention and Handling for Desktops",
      "type": "require",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "inspire",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Microsoft Office",
      "type": "bring",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "bring",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "Treasury",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "the Islamic Republic of Iran",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "see",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Microsoft Office",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "li>Windows",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Unified Extensible Firmware Interface",
      "target": "li>Credential Stealer",
      "type": "accompany",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The Department of Homeland Security",
      "type": "talk",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "Microsoft Office",
      "type": "observe",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "Microsoft",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "New Zealand",
      "target": "Microsoft Office",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "pursue",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "pursue",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "New Zealand",
      "type": "address",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "CVE-2017-3066",
      "type": "address",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "restrict",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Anti-Virus",
      "type": "restrict",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "restrict",
      "confidence": 0.8
    },
    {
      "source": "Adobe ColdFusion",
      "target": "PowerShell Empire",
      "type": "come",
      "confidence": 0.8
    },
    {
      "source": "KrebsOnSecurity",
      "target": "Active Directory",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "KrebsOnSecurity",
      "target": "li>Webshell",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "push",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "fix",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "Microsoft Office",
      "type": "fix",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "href=\"https://owasp.org",
      "type": "tackle",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "turbocharge",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "Microsoft Office",
      "type": "generate",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "generate",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "Local Administrator Password Solution",
      "type": "have",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "the Department of the Treasury’s Financial Crimes Enforcement Network",
      "type": "build",
      "confidence": 0.8
    },
    {
      "source": "the United Kingdom",
      "target": "Microsoft Office",
      "type": "build",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "promote",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "Local Administrator Password Solution",
      "type": "promote",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "PowerShell Empire",
      "type": "use",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Visual Basic",
      "type": "promise",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The National Cybersecurity and Communications Integration Center",
      "type": "make",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "choose",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "Adobe ColdFusion",
      "type": "choose",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "the Cybersecurity and Infrastructure Security Agency",
      "type": "confirm",
      "confidence": 0.8
    },
    {
      "source": "KrebsOnSecurity",
      "target": "Microsoft Office",
      "type": "track",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "the Federal Bureau of Investigation (FBI",
      "type": "offer",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "li>Scan",
      "type": "offer",
      "confidence": 0.8
    },
    {
      "source": "Treasury",
      "target": "Anti-Virus",
      "type": "force",
      "confidence": 0.8
    },
    {
      "source": "PowerShell Empire",
      "target": "Active Directory",
      "type": "tie",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "ISC Stormcast",
      "type": "say",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "wind",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "wind",
      "confidence": 0.8
    },
    {
      "source": "href=\"https://github.com",
      "target": "href=\"https://blogs.microsoft.com",
      "type": "create",
      "confidence": 0.8
    },
    {
      "source": "the Cybersecurity and Infrastructure Security Agency",
      "target": "PowerShell Empire",
      "type": "promote",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "knock",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The National Cybersecurity and Communications Integration Center",
      "type": "knock",
      "confidence": 0.8
    },
    {
      "source": "National Cybersecurity and Communications Integration Center",
      "target": "Australia",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Mimikatz",
      "target": "href=\"https://github.com",
      "type": "access",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "push",
      "confidence": 0.8
    },
    {
      "source": "redirection.</li",
      "target": "href=\"https://github.com",
      "type": "prevent",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus",
      "target": "network.</li",
      "type": "affect",
      "confidence": 0.8
    },
    {
      "source": "Anti-Virus",
      "target": "CVE-2020-0610",
      "type": "affect",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "type": "uncover",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "carry",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "spoof",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The Department of Homeland Security",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "The Department of Homeland Security",
      "target": "The National Cybersecurity and Communications Integration Center",
      "type": "trail",
      "confidence": 0.8
    },
    {
      "source": "ISC Stormcast",
      "target": "The Department of Homeland Security",
      "type": "blast",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "allege",
      "confidence": 0.8
    },
    {
      "source": "Microsoft Office",
      "target": "New Zealand",
      "type": "allege",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "be",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "exact",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "patch",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "patch",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "The Department of Homeland Security",
      "type": "patch",
      "confidence": 0.8
    },
    {
      "source": "Xavier&&#x23&#x3b;x26&#x3b;&#x23&#x3b;39&#x3b;s",
      "target": "National Cybersecurity and Communications Integration Center",
      "type": "allow",
      "confidence": 0.8
    }
  ],
  "metadata": {
    "num_entities": 414,
    "num_relationships": 896,
    "temporal_enabled": true,
    "timestamp": "2025-12-29T22:07:23.161559",
    "entity_resolution_applied": false
  }
}