G0005-technique-relationship-example.json

{
    "type": "bundle",
    "id": "bundle--d8be14ca-02ac-49cf-b728-66b63b5eb4bb",
    "spec_version": "2.0",
    "objects": [
        {
            "type": "relationship",
            "target_ref": "attack-pattern--830c9528-df21-472c-8c14-a036bf17d665",
            "description": "[APT12](https://attack.mitre.org/groups/G0005) has used blogs and WordPress for C2 infrastructure.",
            "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
            "created": "2019-06-10T16:34:59.315Z",
            "id": "relationship--5a49400c-2003-463c-8e6e-97b79f560675",
            "source_ref": "intrusion-set--c47f937f-1022-4f42-8525-e7a4779a14cb",
            "modified": "2019-06-10T19:28:00.985Z",
            "object_marking_refs": [
                "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
            ],
            "external_references": [
                {
                    "description": "Meyers, A. (2013, March 29). Whois Numbered Panda. Retrieved January 14, 2016.",
                    "source_name": "Meyers Numbered Panda",
                    "url": "http://www.crowdstrike.com/blog/whois-numbered-panda/"
                }
            ],
            "relationship_type": "uses"
        }
    ]
}