{
    "schema": "attack_flow_v2",
    "theme": "dark_theme",
    "objects": [
        {
            "id": "flow",
            "instance": "c616ef4f-5a72-4529-9b06-bc4a9279c2f6",
            "properties": [
                [
                    "name",
                    "ToolShell Vulnerability in Sharepoint"
                ],
                [
                    "description",
                    "A widespread vulnerability in Microsoft Sharepoint on-premises leads to remote code execution and credential theft."
                ],
                [
                    "author",
                    [
                        [
                            "name",
                            "Mark Haase"
                        ],
                        [
                            "identity_class",
                            "individual"
                        ],
                        [
                            "contact_information",
                            "mhaase@mitre.org"
                        ]
                    ]
                ],
                [
                    "scope",
                    "campaign"
                ],
                [
                    "external_references",
                    [
                        [
                            "d1efada569208bce76f2665b28a2f817",
                            [
                                [
                                    "source_name",
                                    "Understand the SharePoint RCE: Exploitations, Detections, and Mitigations"
                                ],
                                [
                                    "description",
                                    "Akamai Security Intelligence Group"
                                ],
                                [
                                    "url",
                                    "https://www.akamai.com/blog/security-research/sharepoint-vulnerability-rce-active-exploitation-detections-mitigations "
                                ]
                            ]
                        ],
                        [
                            "712ae8800b77bb5519d736c79af0305f",
                            [
                                [
                                    "source_name",
                                    "Active Exploitation of Microsoft SharePoint Vulnerabilities: Threat Brief"
                                ],
                                [
                                    "description",
                                    "Palo Alto – Unit 42"
                                ],
                                [
                                    "url",
                                    "https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/"
                                ]
                            ]
                        ],
                        [
                            "d931f87665bbc433dcfa75ecd91068f2",
                            [
                                [
                                    "source_name",
                                    "ToolShell: A SharePoint RCE chain actively exploited "
                                ],
                                [
                                    "description",
                                    "Varonis Threat Labs"
                                ],
                                [
                                    "url",
                                    "https://www.varonis.com/blog/toolshell-sharepoint-rce"
                                ]
                            ]
                        ]
                    ]
                ],
                [
                    "created",
                    {
                        "time": "2025-07-28T11:17:33.949-04:00",
                        "zone": "America/New_York"
                    }
                ]
            ],
            "objects": [
                "61757f61-5065-4676-a01f-788518cfa659",
                "6a48352c-ff5d-4a2e-9360-549e5d446a87",
                "b5985f73-1c23-4adc-a8f4-34b40051dbb3",
                "b6e078ef-d935-40eb-ad1f-27a3b42165a8",
                "d93174fc-65e2-4735-af8c-464d9ccd647b",
                "0ef98e80-0d7b-4e29-b733-3b6cdf9f8ae5",
                "e6afb6e0-1ce7-4ff5-b233-2d8fe8b219d8",
                "0dc1068c-2e95-4848-adcb-9f63f66d1033",
                "25312e55-8160-4a75-a24f-bfad68ef6233",
                "711ec881-f8fb-45d2-91ff-07549a4d076a",
                "7e7517c4-7dc3-4c58-b6c4-3566cde41745",
                "c9bf8259-a76e-4dc6-91f0-6aa1e3209944",
                "83551642-972e-405b-8c29-dbf9f4b353c8",
                "35e79d6f-2ea4-48b8-b5eb-041d5586fcfb",
                "75b5e3bf-8e35-41fc-be22-b37c6b65a2f0",
                "571845af-188c-4cfa-8ee5-254f16a4ce3e",
                "d5ee4069-8d23-49b8-ab8d-e40b33f11bb3",
                "4022b36e-2711-4683-aec3-50569f864e80",
                "0c3bd571-baec-46a9-baba-532d8d10c3a5",
                "263a5f08-8c5e-42b2-b93f-34f6d0260f48",
                "233e1488-f1fc-4ad3-81f4-76e4e661221b",
                "6fcf3b73-782f-45fd-ba41-926da5a9a302",
                "128eb846-60c7-475f-bae9-a7a063b7467b",
                "931413ef-c0e4-4438-af57-d96ab837044c",
                "1fe28db9-9a63-4020-82b4-352de6285ef4",
                "424d5ce0-c529-42b7-9d66-5da730b538c6",
                "9b753680-802f-4ca5-b4d2-557a3354a21c",
                "2d99f669-8541-4e89-b1f2-c8e5bad3d085",
                "7c179e59-d3c0-4dc5-a1ea-e9739286a954",
                "5a23dfb4-4ce4-4805-b9f6-eec679ab1e8f",
                "5d9c307c-2ec3-430e-911c-1f90efcfc29e",
                "dca77a67-5c5e-4dae-90cf-f88fd9993648",
                "a9dd4259-c077-4bec-9166-6c94a4ae8d70",
                "fc666848-ebd8-4af4-a926-580fcdffaed2",
                "3126ebce-3f8d-4685-9985-5106af6cc4d2",
                "f162ae8a-a6c9-4eeb-b6e0-7ee6f39f8e2e",
                "6535fc9f-c489-4ff4-b3ed-a290a25da480",
                "9c343508-dc18-4c18-bb3f-720255216309",
                "d2509fcf-8574-42c5-9b9c-aefc7f70c1cb",
                "6f4c597c-fa8a-4621-a81d-c697c8e87265",
                "27d8f506-70aa-4732-8011-d8705d75b94a",
                "498fda9e-66c9-48e7-8b3a-32e96c830033",
                "e5000cc6-e025-44ff-9d81-513ad0cbbf86",
                "569b8f7c-59f2-4df3-9fd9-f8c268130cd9",
                "57890b7f-d16b-49a7-bc5d-fd5b68e2eee0",
                "05262d6e-2758-46f6-8061-2e46d7003b6d",
                "777dd3e3-48a8-4d7a-9002-aa19fdc07aa7",
                "3d049b16-d78d-4fd8-b2a4-91a7d159e827",
                "d2dada60-cc73-4b2d-b652-84a9104bcb37",
                "845e5642-6ed8-4403-864e-6234ef03209c",
                "008353db-6512-4d03-aeea-0bd065ed0a97",
                "f3f53445-df65-439e-8d00-6798a6ae52c7",
                "637a45fa-407f-41c3-994a-536860d4bf3f",
                "54f36148-bba7-4a97-aaa5-8493be71ef0d",
                "0b2518af-d570-43f3-b1c6-90988a96ace8",
                "9f90fa81-aa0e-4caa-b754-e33d491b56c1",
                "3e5ecd65-6165-4dfb-9642-2b49ce2e80a1",
                "5ecca340-5fd5-45f9-acb5-136cbe15dac8",
                "d1ac682d-4af2-4f22-9816-35516654dccb",
                "88ec52f4-e6a8-4566-a5ea-2148e438e4cf",
                "f3966e0f-075c-4ce1-a341-dae0e7981c2b",
                "e75d8848-b1b6-4fa9-80d5-5f50d94c387b",
                "575afe87-6e37-42a6-8327-697623902e25"
            ]
        },
        {
            "id": "dynamic_line",
            "instance": "61757f61-5065-4676-a01f-788518cfa659",
            "source": "1f347805-1ba0-4bd6-9b7f-01a6845a7066",
            "target": "8055a124-2575-49a6-9c9f-f6d82a82871e",
            "handles": [
                "3aacce34-0aa6-4238-9d2b-cdaf24e43a63"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "1f347805-1ba0-4bd6-9b7f-01a6845a7066"
        },
        {
            "id": "generic_latch",
            "instance": "8055a124-2575-49a6-9c9f-f6d82a82871e"
        },
        {
            "id": "generic_handle",
            "instance": "3aacce34-0aa6-4238-9d2b-cdaf24e43a63"
        },
        {
            "id": "dynamic_line",
            "instance": "6a48352c-ff5d-4a2e-9360-549e5d446a87",
            "source": "d1b50317-5e3e-4624-bd1c-615352ac507b",
            "target": "3653df8d-bae6-4c80-845c-b24e14987159",
            "handles": [
                "0c9c2587-c66d-4944-82d9-1c041f4ea66b"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "d1b50317-5e3e-4624-bd1c-615352ac507b"
        },
        {
            "id": "generic_latch",
            "instance": "3653df8d-bae6-4c80-845c-b24e14987159"
        },
        {
            "id": "generic_handle",
            "instance": "0c9c2587-c66d-4944-82d9-1c041f4ea66b"
        },
        {
            "id": "dynamic_line",
            "instance": "b5985f73-1c23-4adc-a8f4-34b40051dbb3",
            "source": "8249b0ab-6495-422f-9e11-1382b76ddb61",
            "target": "fb40587a-6680-4d9b-b181-34e151314e47",
            "handles": [
                "ab29fab3-0430-4fe4-a46e-c5478a1225b1"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "8249b0ab-6495-422f-9e11-1382b76ddb61"
        },
        {
            "id": "generic_latch",
            "instance": "fb40587a-6680-4d9b-b181-34e151314e47"
        },
        {
            "id": "generic_handle",
            "instance": "ab29fab3-0430-4fe4-a46e-c5478a1225b1"
        },
        {
            "id": "dynamic_line",
            "instance": "b6e078ef-d935-40eb-ad1f-27a3b42165a8",
            "source": "0e8591ad-6f86-4c30-ad88-5d2c0a738a6b",
            "target": "02dacaf8-444d-4e6e-995c-ecfdc1722901",
            "handles": [
                "790c1a05-3ce2-4bab-9e08-bc8f5002b1be"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "0e8591ad-6f86-4c30-ad88-5d2c0a738a6b"
        },
        {
            "id": "generic_latch",
            "instance": "02dacaf8-444d-4e6e-995c-ecfdc1722901"
        },
        {
            "id": "generic_handle",
            "instance": "790c1a05-3ce2-4bab-9e08-bc8f5002b1be"
        },
        {
            "id": "dynamic_line",
            "instance": "d93174fc-65e2-4735-af8c-464d9ccd647b",
            "source": "cd6e6816-10fb-47e8-b06f-3a992a274b35",
            "target": "69bfc866-a92c-4e05-9ddd-63f620f99a4d",
            "handles": [
                "e16e5708-ffc3-4011-83a9-49d9e3ff9b00"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "cd6e6816-10fb-47e8-b06f-3a992a274b35"
        },
        {
            "id": "generic_latch",
            "instance": "69bfc866-a92c-4e05-9ddd-63f620f99a4d"
        },
        {
            "id": "generic_handle",
            "instance": "e16e5708-ffc3-4011-83a9-49d9e3ff9b00"
        },
        {
            "id": "dynamic_line",
            "instance": "0ef98e80-0d7b-4e29-b733-3b6cdf9f8ae5",
            "source": "ccfd251e-feb1-4b4f-8a83-404b78a4b344",
            "target": "df4e6d09-7f6f-41bc-8181-cfe5c3ea68a1",
            "handles": [
                "b8b324ef-d61e-424e-9dc1-d816342aa453"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "ccfd251e-feb1-4b4f-8a83-404b78a4b344"
        },
        {
            "id": "generic_latch",
            "instance": "df4e6d09-7f6f-41bc-8181-cfe5c3ea68a1"
        },
        {
            "id": "generic_handle",
            "instance": "b8b324ef-d61e-424e-9dc1-d816342aa453"
        },
        {
            "id": "dynamic_line",
            "instance": "e6afb6e0-1ce7-4ff5-b233-2d8fe8b219d8",
            "source": "991c5d34-2946-4be8-b675-b5d4d4d6bd36",
            "target": "49cae615-41cb-4212-a45f-20252faa177a",
            "handles": [
                "be5e1674-eb2f-4860-9016-d7e66bedc022"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "991c5d34-2946-4be8-b675-b5d4d4d6bd36"
        },
        {
            "id": "generic_latch",
            "instance": "49cae615-41cb-4212-a45f-20252faa177a"
        },
        {
            "id": "generic_handle",
            "instance": "be5e1674-eb2f-4860-9016-d7e66bedc022"
        },
        {
            "id": "dynamic_line",
            "instance": "0dc1068c-2e95-4848-adcb-9f63f66d1033",
            "source": "af948809-5ea8-4f85-aaaa-e22e28e3f582",
            "target": "0043ff78-cd71-4a4b-b00b-b133face2160",
            "handles": [
                "f4d2f81d-b087-4276-80b3-b88cc3c8fa7a"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "af948809-5ea8-4f85-aaaa-e22e28e3f582"
        },
        {
            "id": "generic_latch",
            "instance": "0043ff78-cd71-4a4b-b00b-b133face2160"
        },
        {
            "id": "generic_handle",
            "instance": "f4d2f81d-b087-4276-80b3-b88cc3c8fa7a"
        },
        {
            "id": "dynamic_line",
            "instance": "25312e55-8160-4a75-a24f-bfad68ef6233",
            "source": "0821d513-036f-496c-8564-6d7a652cce9f",
            "target": "e1b7fead-64e9-467e-a408-a902a189d791",
            "handles": [
                "ba7d8004-490e-4773-8590-d57f4905bc6f"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "0821d513-036f-496c-8564-6d7a652cce9f"
        },
        {
            "id": "generic_latch",
            "instance": "e1b7fead-64e9-467e-a408-a902a189d791"
        },
        {
            "id": "generic_handle",
            "instance": "ba7d8004-490e-4773-8590-d57f4905bc6f"
        },
        {
            "id": "dynamic_line",
            "instance": "711ec881-f8fb-45d2-91ff-07549a4d076a",
            "source": "bc963dd5-559a-4aba-8bb1-f3457eab08c4",
            "target": "2fa8daf6-6d18-4ef9-9cfe-3a4894b641bf",
            "handles": [
                "e352e08f-4e2a-4b1b-a5dd-fc7e14125875"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "bc963dd5-559a-4aba-8bb1-f3457eab08c4"
        },
        {
            "id": "generic_latch",
            "instance": "2fa8daf6-6d18-4ef9-9cfe-3a4894b641bf"
        },
        {
            "id": "generic_handle",
            "instance": "e352e08f-4e2a-4b1b-a5dd-fc7e14125875"
        },
        {
            "id": "dynamic_line",
            "instance": "7e7517c4-7dc3-4c58-b6c4-3566cde41745",
            "source": "d01e70b8-24da-4e90-a3e6-3d5c789042ed",
            "target": "02e7133a-8e95-4b5a-bd9d-5b8ba9ce60dc",
            "handles": [
                "205b8395-4a3e-4baf-9994-a7fd76b5cacf"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "d01e70b8-24da-4e90-a3e6-3d5c789042ed"
        },
        {
            "id": "generic_latch",
            "instance": "02e7133a-8e95-4b5a-bd9d-5b8ba9ce60dc"
        },
        {
            "id": "generic_handle",
            "instance": "205b8395-4a3e-4baf-9994-a7fd76b5cacf"
        },
        {
            "id": "dynamic_line",
            "instance": "c9bf8259-a76e-4dc6-91f0-6aa1e3209944",
            "source": "d42680b3-0241-4534-b37e-0d4f8fbd7580",
            "target": "97484ada-e666-469b-b3a7-0bce737f275d",
            "handles": [
                "e18f4494-174b-4526-bd7c-c5591a57465b"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "d42680b3-0241-4534-b37e-0d4f8fbd7580"
        },
        {
            "id": "generic_latch",
            "instance": "97484ada-e666-469b-b3a7-0bce737f275d"
        },
        {
            "id": "generic_handle",
            "instance": "e18f4494-174b-4526-bd7c-c5591a57465b"
        },
        {
            "id": "dynamic_line",
            "instance": "83551642-972e-405b-8c29-dbf9f4b353c8",
            "source": "033b3b36-5d6a-43e7-945a-4749cf21a37a",
            "target": "2d4f855c-925a-4a34-bf1c-0753244ce47e",
            "handles": [
                "fb664199-767f-4381-b95f-a40455c87102"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "033b3b36-5d6a-43e7-945a-4749cf21a37a"
        },
        {
            "id": "generic_latch",
            "instance": "2d4f855c-925a-4a34-bf1c-0753244ce47e"
        },
        {
            "id": "generic_handle",
            "instance": "fb664199-767f-4381-b95f-a40455c87102"
        },
        {
            "id": "dynamic_line",
            "instance": "35e79d6f-2ea4-48b8-b5eb-041d5586fcfb",
            "source": "32431c64-cd88-4d80-867e-0e08b9a2c2c9",
            "target": "b527e71f-15a8-4d20-a299-eff251a33190",
            "handles": [
                "5f28e14f-8129-4773-bb5c-6c5d2dd1a521"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "32431c64-cd88-4d80-867e-0e08b9a2c2c9"
        },
        {
            "id": "generic_latch",
            "instance": "b527e71f-15a8-4d20-a299-eff251a33190"
        },
        {
            "id": "generic_handle",
            "instance": "5f28e14f-8129-4773-bb5c-6c5d2dd1a521"
        },
        {
            "id": "dynamic_line",
            "instance": "75b5e3bf-8e35-41fc-be22-b37c6b65a2f0",
            "source": "8160fdd0-6cd2-4572-abae-156c3313e39b",
            "target": "387f32a8-ec1b-47e2-9afe-8574223cdcc2",
            "handles": [
                "facf8246-79e2-4af1-ad46-f706d7233944"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "8160fdd0-6cd2-4572-abae-156c3313e39b"
        },
        {
            "id": "generic_latch",
            "instance": "387f32a8-ec1b-47e2-9afe-8574223cdcc2"
        },
        {
            "id": "generic_handle",
            "instance": "facf8246-79e2-4af1-ad46-f706d7233944"
        },
        {
            "id": "dynamic_line",
            "instance": "571845af-188c-4cfa-8ee5-254f16a4ce3e",
            "source": "f42bffb6-7f69-46e9-a7a4-5ca4fb072bd9",
            "target": "e15ede58-5432-4c52-bd32-89afc921ef65",
            "handles": [
                "02a5c282-1baa-485b-b31d-0621c8efa18b"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "f42bffb6-7f69-46e9-a7a4-5ca4fb072bd9"
        },
        {
            "id": "generic_latch",
            "instance": "e15ede58-5432-4c52-bd32-89afc921ef65"
        },
        {
            "id": "generic_handle",
            "instance": "02a5c282-1baa-485b-b31d-0621c8efa18b"
        },
        {
            "id": "dynamic_line",
            "instance": "d5ee4069-8d23-49b8-ab8d-e40b33f11bb3",
            "source": "19c42fa9-0820-4682-a6ff-cefc6f86120a",
            "target": "d1238e21-f4a2-43d3-a14d-021909d7b3a2",
            "handles": [
                "ec0e965e-d3ab-431f-9c96-1f29f52b1260"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "19c42fa9-0820-4682-a6ff-cefc6f86120a"
        },
        {
            "id": "generic_latch",
            "instance": "d1238e21-f4a2-43d3-a14d-021909d7b3a2"
        },
        {
            "id": "generic_handle",
            "instance": "ec0e965e-d3ab-431f-9c96-1f29f52b1260"
        },
        {
            "id": "dynamic_line",
            "instance": "4022b36e-2711-4683-aec3-50569f864e80",
            "source": "053f6341-be64-43e2-b7a1-1c4772958e93",
            "target": "e2dc25f6-155b-49aa-927e-cabfa88066e8",
            "handles": [
                "5a98cd58-a050-4c71-9015-809a82dc6b1f"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "053f6341-be64-43e2-b7a1-1c4772958e93"
        },
        {
            "id": "generic_latch",
            "instance": "e2dc25f6-155b-49aa-927e-cabfa88066e8"
        },
        {
            "id": "generic_handle",
            "instance": "5a98cd58-a050-4c71-9015-809a82dc6b1f"
        },
        {
            "id": "dynamic_line",
            "instance": "0c3bd571-baec-46a9-baba-532d8d10c3a5",
            "source": "28c21edd-05f5-4f3c-9bd6-41aef53bf0c8",
            "target": "e238f82d-92a9-4e61-aabd-b3b096f28682",
            "handles": [
                "8e70b7d4-9bf2-4283-b8fc-fab5930e83ad"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "28c21edd-05f5-4f3c-9bd6-41aef53bf0c8"
        },
        {
            "id": "generic_latch",
            "instance": "e238f82d-92a9-4e61-aabd-b3b096f28682"
        },
        {
            "id": "generic_handle",
            "instance": "8e70b7d4-9bf2-4283-b8fc-fab5930e83ad"
        },
        {
            "id": "dynamic_line",
            "instance": "263a5f08-8c5e-42b2-b93f-34f6d0260f48",
            "source": "8b59d421-fc77-461a-ac6f-66044d2f91ae",
            "target": "2732f9f7-f352-4a9c-9182-3eee2fba4f28",
            "handles": [
                "a5f7a388-0841-4892-a468-5aba7c4918f1"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "8b59d421-fc77-461a-ac6f-66044d2f91ae"
        },
        {
            "id": "generic_latch",
            "instance": "2732f9f7-f352-4a9c-9182-3eee2fba4f28"
        },
        {
            "id": "generic_handle",
            "instance": "a5f7a388-0841-4892-a468-5aba7c4918f1"
        },
        {
            "id": "dynamic_line",
            "instance": "233e1488-f1fc-4ad3-81f4-76e4e661221b",
            "source": "4eb509c7-8014-4f7c-bb39-92c6a682879b",
            "target": "729c7f42-acf4-4c45-8070-e2858ae1742d",
            "handles": [
                "e485f852-d631-4388-845f-6dcaf5a7bd77"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "4eb509c7-8014-4f7c-bb39-92c6a682879b"
        },
        {
            "id": "generic_latch",
            "instance": "729c7f42-acf4-4c45-8070-e2858ae1742d"
        },
        {
            "id": "generic_handle",
            "instance": "e485f852-d631-4388-845f-6dcaf5a7bd77"
        },
        {
            "id": "dynamic_line",
            "instance": "6fcf3b73-782f-45fd-ba41-926da5a9a302",
            "source": "c2cb75ba-a4b3-4328-be93-a2d90c76285a",
            "target": "0bc7d138-2007-4fe9-a5a6-2868fc885a5f",
            "handles": [
                "e089eca7-bbff-4676-807c-0b2bd14f5ee0"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "c2cb75ba-a4b3-4328-be93-a2d90c76285a"
        },
        {
            "id": "generic_latch",
            "instance": "0bc7d138-2007-4fe9-a5a6-2868fc885a5f"
        },
        {
            "id": "generic_handle",
            "instance": "e089eca7-bbff-4676-807c-0b2bd14f5ee0"
        },
        {
            "id": "dynamic_line",
            "instance": "128eb846-60c7-475f-bae9-a7a063b7467b",
            "source": "cd957357-3c01-4e1b-9edb-8c124b087c16",
            "target": "d3797833-95e0-414b-baff-f5a0acab218a",
            "handles": [
                "863553fa-34dd-4bc4-8a8d-c2a77fd9df10"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "cd957357-3c01-4e1b-9edb-8c124b087c16"
        },
        {
            "id": "generic_latch",
            "instance": "d3797833-95e0-414b-baff-f5a0acab218a"
        },
        {
            "id": "generic_handle",
            "instance": "863553fa-34dd-4bc4-8a8d-c2a77fd9df10"
        },
        {
            "id": "dynamic_line",
            "instance": "931413ef-c0e4-4438-af57-d96ab837044c",
            "source": "d7e9f9e6-8410-4e2e-97a9-70ae07b1f6a8",
            "target": "80d93c71-717e-48bb-a0dc-da673499b980",
            "handles": [
                "2b7f0b7d-f5a0-42bd-8530-4938f3d4ca73"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "d7e9f9e6-8410-4e2e-97a9-70ae07b1f6a8"
        },
        {
            "id": "generic_latch",
            "instance": "80d93c71-717e-48bb-a0dc-da673499b980"
        },
        {
            "id": "generic_handle",
            "instance": "2b7f0b7d-f5a0-42bd-8530-4938f3d4ca73"
        },
        {
            "id": "dynamic_line",
            "instance": "1fe28db9-9a63-4020-82b4-352de6285ef4",
            "source": "6a3765f7-5a69-445e-bb15-612afd6577f7",
            "target": "b7e72eb5-ba82-464e-8486-e09a88caf7fd",
            "handles": [
                "fc615760-3ae2-4b25-a638-5c25cf3f1bf7"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "6a3765f7-5a69-445e-bb15-612afd6577f7"
        },
        {
            "id": "generic_latch",
            "instance": "b7e72eb5-ba82-464e-8486-e09a88caf7fd"
        },
        {
            "id": "generic_handle",
            "instance": "fc615760-3ae2-4b25-a638-5c25cf3f1bf7"
        },
        {
            "id": "dynamic_line",
            "instance": "424d5ce0-c529-42b7-9d66-5da730b538c6",
            "source": "a295e2be-595f-483d-9ff5-2827c1f4a59e",
            "target": "2431ed62-7ec9-4f0b-87ce-5f12dd8c0f46",
            "handles": [
                "bcae63f4-5498-42d2-967c-4e3166d7fa08"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "a295e2be-595f-483d-9ff5-2827c1f4a59e"
        },
        {
            "id": "generic_latch",
            "instance": "2431ed62-7ec9-4f0b-87ce-5f12dd8c0f46"
        },
        {
            "id": "generic_handle",
            "instance": "bcae63f4-5498-42d2-967c-4e3166d7fa08"
        },
        {
            "id": "dynamic_line",
            "instance": "9b753680-802f-4ca5-b4d2-557a3354a21c",
            "source": "ad08089f-875b-4978-ab4a-6750f875ca96",
            "target": "2ea49c33-51b1-4d66-abec-b6bf4e6aaf5c",
            "handles": [
                "0fdced58-e93d-49ae-a6a9-37e047f84562"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "ad08089f-875b-4978-ab4a-6750f875ca96"
        },
        {
            "id": "generic_latch",
            "instance": "2ea49c33-51b1-4d66-abec-b6bf4e6aaf5c"
        },
        {
            "id": "generic_handle",
            "instance": "0fdced58-e93d-49ae-a6a9-37e047f84562"
        },
        {
            "id": "dynamic_line",
            "instance": "2d99f669-8541-4e89-b1f2-c8e5bad3d085",
            "source": "7fdc7ff1-8398-439e-bab9-17755c798767",
            "target": "217469df-b945-48ef-b5b8-7e690aec5712",
            "handles": [
                "d0d2d798-bebb-48c4-b5e6-8fe664681285"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "7fdc7ff1-8398-439e-bab9-17755c798767"
        },
        {
            "id": "generic_latch",
            "instance": "217469df-b945-48ef-b5b8-7e690aec5712"
        },
        {
            "id": "generic_handle",
            "instance": "d0d2d798-bebb-48c4-b5e6-8fe664681285"
        },
        {
            "id": "dynamic_line",
            "instance": "7c179e59-d3c0-4dc5-a1ea-e9739286a954",
            "source": "f272c315-020f-454c-80a8-8e3a3c799397",
            "target": "1f71eceb-c086-44d8-9362-3c5764fd17f1",
            "handles": [
                "76727482-c484-4b48-81cc-f120c84de342"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "f272c315-020f-454c-80a8-8e3a3c799397"
        },
        {
            "id": "generic_latch",
            "instance": "1f71eceb-c086-44d8-9362-3c5764fd17f1"
        },
        {
            "id": "generic_handle",
            "instance": "76727482-c484-4b48-81cc-f120c84de342"
        },
        {
            "id": "dynamic_line",
            "instance": "5a23dfb4-4ce4-4805-b9f6-eec679ab1e8f",
            "source": "1f5424ea-1bd7-42a2-a870-4a21c2a20bef",
            "target": "bdc7d397-a39b-41ef-aced-4bc5e4e3ac88",
            "handles": [
                "e2d2ab53-ad90-4062-9a0a-43b17fd0e9cf"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "1f5424ea-1bd7-42a2-a870-4a21c2a20bef"
        },
        {
            "id": "generic_latch",
            "instance": "bdc7d397-a39b-41ef-aced-4bc5e4e3ac88"
        },
        {
            "id": "generic_handle",
            "instance": "e2d2ab53-ad90-4062-9a0a-43b17fd0e9cf"
        },
        {
            "id": "dynamic_line",
            "instance": "5d9c307c-2ec3-430e-911c-1f90efcfc29e",
            "source": "cf3c95dc-3e78-49f5-89a2-905f1d66e084",
            "target": "3b36d723-f769-4ebc-95fb-3e4d944b20ee",
            "handles": [
                "2e4f47a4-e12d-450e-8548-48f8fe92b2e3"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "cf3c95dc-3e78-49f5-89a2-905f1d66e084"
        },
        {
            "id": "generic_latch",
            "instance": "3b36d723-f769-4ebc-95fb-3e4d944b20ee"
        },
        {
            "id": "generic_handle",
            "instance": "2e4f47a4-e12d-450e-8548-48f8fe92b2e3"
        },
        {
            "id": "dynamic_line",
            "instance": "dca77a67-5c5e-4dae-90cf-f88fd9993648",
            "source": "94412c1b-ef54-4577-b50c-a0db26430b5b",
            "target": "b74b236b-e97a-4691-a430-79ace2a40c6c",
            "handles": [
                "1b6e9476-cb63-4dbe-b92c-8f7c06ce91a4"
            ]
        },
        {
            "id": "generic_latch",
            "instance": "94412c1b-ef54-4577-b50c-a0db26430b5b"
        },
        {
            "id": "generic_latch",
            "instance": "b74b236b-e97a-4691-a430-79ace2a40c6c"
        },
        {
            "id": "generic_handle",
            "instance": "1b6e9476-cb63-4dbe-b92c-8f7c06ce91a4"
        },
        {
            "id": "action",
            "instance": "a9dd4259-c077-4bec-9166-6c94a4ae8d70",
            "properties": [
                [
                    "name",
                    "Exploit Public-Facing Application"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0001"
                        ],
                        [
                            "technique",
                            "T1190"
                        ]
                    ]
                ],
                [
                    "description",
                    "Attackers use an authentication bypass vulnerability in Microsoft Sharepoint (on-prem) to send a specially crafted HTTP request with a manipulated Referer header to the ToolPane endpoint."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "0a05219d-c402-4093-8369-5fb1a6440df6",
                "30": "73e88ebf-cb26-485a-b6da-4e89b77e3646",
                "60": "6a83443e-c61b-48b8-9759-04c5a7fa1a1e",
                "90": "e4a5ab68-b512-4e7d-8ea4-9409a28b502f",
                "120": "9d941c20-7676-4b28-befc-cea333492145",
                "150": "593a4d99-6ea2-44b6-9f43-4e4f4c93504a",
                "180": "3a16bbbc-f9aa-4aed-a32e-a43316780969",
                "210": "7f78e851-aa47-43af-8441-d53e2944965e",
                "240": "96ff145f-e647-4a0c-aba1-3b0a440e6c57",
                "270": "8e238756-4577-461b-9092-ef109c5d16c1",
                "300": "61e05828-b5f0-4a5d-b3fc-340c3437a7a6",
                "330": "e12ec02e-d66a-45eb-9740-3508657e652e"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "0a05219d-c402-4093-8369-5fb1a6440df6",
            "latches": [
                "1f347805-1ba0-4bd6-9b7f-01a6845a7066",
                "8249b0ab-6495-422f-9e11-1382b76ddb61"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "73e88ebf-cb26-485a-b6da-4e89b77e3646",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6a83443e-c61b-48b8-9759-04c5a7fa1a1e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e4a5ab68-b512-4e7d-8ea4-9409a28b502f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9d941c20-7676-4b28-befc-cea333492145",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "593a4d99-6ea2-44b6-9f43-4e4f4c93504a",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "3a16bbbc-f9aa-4aed-a32e-a43316780969",
            "latches": [
                "e15ede58-5432-4c52-bd32-89afc921ef65"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "7f78e851-aa47-43af-8441-d53e2944965e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "96ff145f-e647-4a0c-aba1-3b0a440e6c57",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "8e238756-4577-461b-9092-ef109c5d16c1",
            "latches": [
                "d1b50317-5e3e-4624-bd1c-615352ac507b"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "61e05828-b5f0-4a5d-b3fc-340c3437a7a6",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "e12ec02e-d66a-45eb-9740-3508657e652e",
            "latches": []
        },
        {
            "id": "vulnerability",
            "instance": "fc666848-ebd8-4af4-a926-580fcdffaed2",
            "properties": [
                [
                    "name",
                    "CVE-2025-49706"
                ],
                [
                    "description",
                    "Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network."
                ]
            ],
            "anchors": {
                "0": "d253fa70-e752-412f-8863-62817a88c9bd",
                "30": "e430d96c-496c-4c3d-990a-f0161e5884fa",
                "60": "e51fef32-854f-4264-a219-7d58d6f35f3d",
                "90": "d1b8bdc5-2995-4509-a562-49e87ba69c99",
                "120": "3ba700bc-80c3-45bd-a2ea-935c87289926",
                "150": "971293fa-cc9c-481f-a294-b1153e7ec7ab",
                "180": "9b8bcdfa-f057-4cf8-b428-04dc705af56c",
                "210": "9d8cd06a-425c-4dc7-9cc0-ab5afe45d85f",
                "240": "a4eb96b5-92a8-4419-8a8c-65dace81f257",
                "270": "18673bd8-b13c-41d3-9583-e147c0b84110",
                "300": "0f1198cd-ed7f-4dd7-ae1c-5787772ca0a5",
                "330": "c5b62ca4-434c-4580-a0cf-40f7d256059a"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "d253fa70-e752-412f-8863-62817a88c9bd",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "e430d96c-496c-4c3d-990a-f0161e5884fa",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e51fef32-854f-4264-a219-7d58d6f35f3d",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "d1b8bdc5-2995-4509-a562-49e87ba69c99",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "3ba700bc-80c3-45bd-a2ea-935c87289926",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "971293fa-cc9c-481f-a294-b1153e7ec7ab",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "9b8bcdfa-f057-4cf8-b428-04dc705af56c",
            "latches": [
                "8055a124-2575-49a6-9c9f-f6d82a82871e"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "9d8cd06a-425c-4dc7-9cc0-ab5afe45d85f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "a4eb96b5-92a8-4419-8a8c-65dace81f257",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "18673bd8-b13c-41d3-9583-e147c0b84110",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0f1198cd-ed7f-4dd7-ae1c-5787772ca0a5",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "c5b62ca4-434c-4580-a0cf-40f7d256059a",
            "latches": []
        },
        {
            "id": "note",
            "instance": "3126ebce-3f8d-4685-9985-5106af6cc4d2",
            "properties": [
                [
                    "abstract",
                    "Manipulated Referer Header"
                ],
                [
                    "content",
                    "Referer: /_layouts/SignOut.aspx"
                ],
                [
                    "authors",
                    []
                ]
            ],
            "anchors": {
                "0": "01bdaf21-3978-4cb7-8d24-864fe642d6aa",
                "30": "4886614d-e560-450b-8ab4-1b8a0c9ffe89",
                "60": "b4672543-3fe4-4caa-9fa2-539ec36bf82b",
                "90": "6c59e964-e02c-45a3-8704-f6147360a9a2",
                "120": "14b1cebf-3ad3-4054-8350-7ce9a003c174",
                "150": "216e714f-9110-4edc-aab9-87b04b0f1d12",
                "180": "0622418a-c6df-4b47-afb7-705e63370664",
                "210": "cd26ccb7-115e-4f78-b021-4cd1a3fe6578",
                "240": "ed78b07a-b02d-4843-bafa-b334f5ddf251",
                "270": "8d6dd1f5-8ed0-4da2-aeac-cc87b45f12ab",
                "300": "6f273877-4d8e-45fd-844a-97defd3dc66b",
                "330": "886e8112-5d2f-4510-bff8-dfb166b8621b"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "01bdaf21-3978-4cb7-8d24-864fe642d6aa",
            "latches": [
                "f42bffb6-7f69-46e9-a7a4-5ca4fb072bd9"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "4886614d-e560-450b-8ab4-1b8a0c9ffe89",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b4672543-3fe4-4caa-9fa2-539ec36bf82b",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6c59e964-e02c-45a3-8704-f6147360a9a2",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "14b1cebf-3ad3-4054-8350-7ce9a003c174",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "216e714f-9110-4edc-aab9-87b04b0f1d12",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "0622418a-c6df-4b47-afb7-705e63370664",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "cd26ccb7-115e-4f78-b021-4cd1a3fe6578",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "ed78b07a-b02d-4843-bafa-b334f5ddf251",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "8d6dd1f5-8ed0-4da2-aeac-cc87b45f12ab",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6f273877-4d8e-45fd-844a-97defd3dc66b",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "886e8112-5d2f-4510-bff8-dfb166b8621b",
            "latches": []
        },
        {
            "id": "action",
            "instance": "f162ae8a-a6c9-4eeb-b6e0-7ee6f39f8e2e",
            "properties": [
                [
                    "name",
                    "Exploit Public-Facing Application"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0001"
                        ],
                        [
                            "technique",
                            "T1190"
                        ]
                    ]
                ],
                [
                    "description",
                    "The same HTTP request also contains an exploit for a deserialization vulnerability that allows remote code execution."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "164df783-c765-4b03-9233-86082face29c",
                "30": "87546a80-5186-4870-aeb5-7b5f076ba431",
                "60": "0ddb9518-efea-43d0-92e5-b164f115e5cf",
                "90": "c9d3e872-8fdb-435f-8bea-393918d71bd9",
                "120": "80dc1f9c-d021-49e4-9a9b-a249d2e45cef",
                "150": "5f15ebce-8aae-4dea-b5db-d3996165b69a",
                "180": "1dcc1b9d-568e-44e7-a3f4-12e66b535a89",
                "210": "c19d1311-c173-462c-8008-00420a626a23",
                "240": "925f41fe-77ee-4136-8a0b-f500ce39cedf",
                "270": "da4eb0d4-78c2-4991-84b6-1aaf3323b837",
                "300": "39848060-c070-4e66-b171-9ee52430a3a2",
                "330": "cc4010cf-e6bd-4cb8-80af-7b89b7e0d28b"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "164df783-c765-4b03-9233-86082face29c",
            "latches": [
                "0e8591ad-6f86-4c30-ad88-5d2c0a738a6b"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "87546a80-5186-4870-aeb5-7b5f076ba431",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0ddb9518-efea-43d0-92e5-b164f115e5cf",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "c9d3e872-8fdb-435f-8bea-393918d71bd9",
            "latches": [
                "3653df8d-bae6-4c80-845c-b24e14987159"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "80dc1f9c-d021-49e4-9a9b-a249d2e45cef",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "5f15ebce-8aae-4dea-b5db-d3996165b69a",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1dcc1b9d-568e-44e7-a3f4-12e66b535a89",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "c19d1311-c173-462c-8008-00420a626a23",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "925f41fe-77ee-4136-8a0b-f500ce39cedf",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "da4eb0d4-78c2-4991-84b6-1aaf3323b837",
            "latches": [
                "cd6e6816-10fb-47e8-b06f-3a992a274b35"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "39848060-c070-4e66-b171-9ee52430a3a2",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "cc4010cf-e6bd-4cb8-80af-7b89b7e0d28b",
            "latches": []
        },
        {
            "id": "url",
            "instance": "6535fc9f-c489-4ff4-b3ed-a290a25da480",
            "properties": [
                [
                    "value",
                    "/_layouts/15/ToolPane.aspx?DisplayMode=Edit&a=/ToolPane.aspx"
                ]
            ],
            "anchors": {
                "0": "a6134026-4740-4ab5-bc4a-d0f2349e9da4",
                "30": "2147e970-ab95-4152-bdf7-a31eed8598bb",
                "60": "c999b8df-3f6d-48cf-823c-623803ed42e6",
                "90": "d9232473-a39d-4ccb-8686-acce3759480d",
                "120": "896af17f-0e43-460e-8f5f-8f9763f94c02",
                "150": "c419bd39-d37c-4d26-9275-041f9af73d60",
                "180": "62cf883f-e8ee-4818-9601-a456ff0c266f",
                "210": "c220e17f-91f8-45d4-9509-0c9511cb7bc7",
                "240": "b58c0c42-3b35-4dad-a987-a0b270fa0262",
                "270": "fd7966d0-74b2-4c0a-8b2f-25f4d0825452",
                "300": "7286cac0-46bd-4bc0-90e3-f80fb973b401",
                "330": "b08ec846-b400-4062-9ddf-9ac3fec4ec0d"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "a6134026-4740-4ab5-bc4a-d0f2349e9da4",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "2147e970-ab95-4152-bdf7-a31eed8598bb",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "c999b8df-3f6d-48cf-823c-623803ed42e6",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "d9232473-a39d-4ccb-8686-acce3759480d",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "896af17f-0e43-460e-8f5f-8f9763f94c02",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "c419bd39-d37c-4d26-9275-041f9af73d60",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "62cf883f-e8ee-4818-9601-a456ff0c266f",
            "latches": [
                "fb40587a-6680-4d9b-b181-34e151314e47"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "c220e17f-91f8-45d4-9509-0c9511cb7bc7",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b58c0c42-3b35-4dad-a987-a0b270fa0262",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "fd7966d0-74b2-4c0a-8b2f-25f4d0825452",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "7286cac0-46bd-4bc0-90e3-f80fb973b401",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "b08ec846-b400-4062-9ddf-9ac3fec4ec0d",
            "latches": []
        },
        {
            "id": "vulnerability",
            "instance": "9c343508-dc18-4c18-bb3f-720255216309",
            "properties": [
                [
                    "name",
                    "CVE-2025-49704"
                ],
                [
                    "description",
                    "Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network."
                ]
            ],
            "anchors": {
                "0": "4be35043-18dd-4c1b-81c9-36b58c4e4e7e",
                "30": "ceecefd9-f566-444d-91bd-ba5196cee620",
                "60": "e14f05b1-fa20-4897-bbb7-ddd84cd6e522",
                "90": "871878b2-467a-46b0-a943-8f3e9ba954b1",
                "120": "37c1139b-1c43-4ad0-afc4-a6cd8968f863",
                "150": "e5fbe3de-fc0f-41f7-8cfb-3fd237b9516e",
                "180": "67933289-a52b-430f-9c79-02cbe3142a19",
                "210": "0b76128e-c6f4-4d91-9a64-fb9c123e366f",
                "240": "997b3520-661b-4884-b5b1-13e1f357345e",
                "270": "3f12d269-c972-4210-8914-130abe12b38c",
                "300": "f042fad5-e6e0-4e57-87d7-5deedceddb29",
                "330": "e4bd5113-3acf-40f7-bbdb-d328250fa0b9"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "4be35043-18dd-4c1b-81c9-36b58c4e4e7e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "ceecefd9-f566-444d-91bd-ba5196cee620",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e14f05b1-fa20-4897-bbb7-ddd84cd6e522",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "871878b2-467a-46b0-a943-8f3e9ba954b1",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "37c1139b-1c43-4ad0-afc4-a6cd8968f863",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "e5fbe3de-fc0f-41f7-8cfb-3fd237b9516e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "67933289-a52b-430f-9c79-02cbe3142a19",
            "latches": [
                "02dacaf8-444d-4e6e-995c-ecfdc1722901"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "0b76128e-c6f4-4d91-9a64-fb9c123e366f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "997b3520-661b-4884-b5b1-13e1f357345e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "3f12d269-c972-4210-8914-130abe12b38c",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "f042fad5-e6e0-4e57-87d7-5deedceddb29",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "e4bd5113-3acf-40f7-bbdb-d328250fa0b9",
            "latches": []
        },
        {
            "id": "action",
            "instance": "d2509fcf-8574-42c5-9b9c-aefc7f70c1cb",
            "properties": [
                [
                    "name",
                    "PowerShell"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0002"
                        ],
                        [
                            "technique",
                            "T1059.001"
                        ]
                    ]
                ],
                [
                    "description",
                    "The deserialization exploit leads to execution of a powershell payload."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "391de973-8d12-4497-a985-d202bd78f7a3",
                "30": "948f5721-6eaf-41a5-9550-c847026bc2e5",
                "60": "b28e0452-9338-43ea-9db9-83000c6fc62b",
                "90": "94d9ed62-f093-4737-94cf-283bc3f638e6",
                "120": "c15f30eb-7404-4170-9870-4ca018a8161b",
                "150": "7b532aa2-6235-4c82-a50e-c0a75d17e565",
                "180": "9118388a-c379-43ca-a72e-53c8c1521a97",
                "210": "fefcc594-a6b2-4657-94af-f86a180c2487",
                "240": "2da2063f-0b6f-4a79-9695-7c4e20716e6b",
                "270": "7730787f-1db1-4b11-848f-3775f5e410a1",
                "300": "34c1cbf6-0b42-402b-96a0-82a9d904fab8",
                "330": "90208700-6244-4d19-a7ce-d4391cc8d867"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "391de973-8d12-4497-a985-d202bd78f7a3",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "948f5721-6eaf-41a5-9550-c847026bc2e5",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b28e0452-9338-43ea-9db9-83000c6fc62b",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "94d9ed62-f093-4737-94cf-283bc3f638e6",
            "latches": [
                "69bfc866-a92c-4e05-9ddd-63f620f99a4d"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "c15f30eb-7404-4170-9870-4ca018a8161b",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "7b532aa2-6235-4c82-a50e-c0a75d17e565",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "9118388a-c379-43ca-a72e-53c8c1521a97",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "fefcc594-a6b2-4657-94af-f86a180c2487",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "2da2063f-0b6f-4a79-9695-7c4e20716e6b",
            "latches": [
                "ccfd251e-feb1-4b4f-8a83-404b78a4b344"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "7730787f-1db1-4b11-848f-3775f5e410a1",
            "latches": [
                "8b59d421-fc77-461a-ac6f-66044d2f91ae"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "34c1cbf6-0b42-402b-96a0-82a9d904fab8",
            "latches": [
                "cd957357-3c01-4e1b-9edb-8c124b087c16"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "90208700-6244-4d19-a7ce-d4391cc8d867",
            "latches": []
        },
        {
            "id": "action",
            "instance": "6f4c597c-fa8a-4621-a81d-c697c8e87265",
            "properties": [
                [
                    "name",
                    "Web Shell"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0003"
                        ],
                        [
                            "technique",
                            "T1505.003"
                        ]
                    ]
                ],
                [
                    "description",
                    "The attackers deploy an ASPX web shell that is capable of extracting cryptographic signing keys."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "6571e151-bf79-425b-a8cd-15abdebecb89",
                "30": "24d0ba4a-55eb-4b9e-8727-6ea3439f575e",
                "60": "aa4a543e-9df9-49fd-ada5-a87544c01de9",
                "90": "2f82bcaf-e034-4351-b56c-2b47cbf0827a",
                "120": "620f4e06-3031-4927-8fa7-8cf99af57236",
                "150": "bb7acef5-a712-4dd8-87e6-fe0b9c4b0c79",
                "180": "2f7bcc08-2488-434d-8707-dff01f7f3660",
                "210": "a051da61-acf3-43c7-8529-401789b95d76",
                "240": "1eef86d7-f12d-4fed-b783-8492bc88a8e5",
                "270": "a0e8e0e1-2692-4637-aa1a-b09d0553366c",
                "300": "925c75e4-2e71-4855-a0a9-e0cbe385f16e",
                "330": "cb4fe84a-0dbf-4194-8ac7-8bbc5a8da74d"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "6571e151-bf79-425b-a8cd-15abdebecb89",
            "latches": [
                "d01e70b8-24da-4e90-a3e6-3d5c789042ed",
                "d42680b3-0241-4534-b37e-0d4f8fbd7580",
                "033b3b36-5d6a-43e7-945a-4749cf21a37a"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "24d0ba4a-55eb-4b9e-8727-6ea3439f575e",
            "latches": [
                "af948809-5ea8-4f85-aaaa-e22e28e3f582"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "aa4a543e-9df9-49fd-ada5-a87544c01de9",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "2f82bcaf-e034-4351-b56c-2b47cbf0827a",
            "latches": [
                "df4e6d09-7f6f-41bc-8181-cfe5c3ea68a1"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "620f4e06-3031-4927-8fa7-8cf99af57236",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "bb7acef5-a712-4dd8-87e6-fe0b9c4b0c79",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "2f7bcc08-2488-434d-8707-dff01f7f3660",
            "latches": [
                "49cae615-41cb-4212-a45f-20252faa177a"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "a051da61-acf3-43c7-8529-401789b95d76",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "1eef86d7-f12d-4fed-b783-8492bc88a8e5",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "a0e8e0e1-2692-4637-aa1a-b09d0553366c",
            "latches": [
                "0821d513-036f-496c-8564-6d7a652cce9f"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "925c75e4-2e71-4855-a0a9-e0cbe385f16e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "cb4fe84a-0dbf-4194-8ac7-8bbc5a8da74d",
            "latches": [
                "32431c64-cd88-4d80-867e-0e08b9a2c2c9"
            ]
        },
        {
            "id": "note",
            "instance": "27d8f506-70aa-4732-8011-d8705d75b94a",
            "properties": [
                [
                    "abstract",
                    "Akamai / Unit 42 Variant 2"
                ],
                [
                    "content",
                    "This attack path shows the post-exploitation behavior observed in the Akamai report. (Unit 42 published nearly identical intelligence that they called \"Variation 2\".)"
                ],
                [
                    "authors",
                    []
                ]
            ],
            "anchors": {
                "0": "14098e39-3352-4153-a0d6-faadb5647b7e",
                "30": "4b566ea4-5485-43b8-b0e3-730cec2c6f81",
                "60": "da5986d2-1696-490e-946b-33d3b02b66f9",
                "90": "9e459109-6312-4d62-8063-d629ef27105e",
                "120": "42258bb5-9838-4563-b479-2ff5e0dec12c",
                "150": "868a605b-c3b0-4adf-9e3e-048cc5c1d248",
                "180": "125b27e4-fbe1-4a51-8793-8d359d462970",
                "210": "44f8c099-b21d-46d6-84a6-265dd438ff79",
                "240": "75c44779-e436-4f73-9c23-207d3d73dff5",
                "270": "024542d2-c50b-4223-a5f1-6a97c57d2d5d",
                "300": "885fda45-9f77-4a76-95a8-b71724155462",
                "330": "0952d987-0179-4baf-bb1d-3dc8b244ef09"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "14098e39-3352-4153-a0d6-faadb5647b7e",
            "latches": [
                "991c5d34-2946-4be8-b675-b5d4d4d6bd36"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "4b566ea4-5485-43b8-b0e3-730cec2c6f81",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "da5986d2-1696-490e-946b-33d3b02b66f9",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9e459109-6312-4d62-8063-d629ef27105e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "42258bb5-9838-4563-b479-2ff5e0dec12c",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "868a605b-c3b0-4adf-9e3e-048cc5c1d248",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "125b27e4-fbe1-4a51-8793-8d359d462970",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "44f8c099-b21d-46d6-84a6-265dd438ff79",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "75c44779-e436-4f73-9c23-207d3d73dff5",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "024542d2-c50b-4223-a5f1-6a97c57d2d5d",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "885fda45-9f77-4a76-95a8-b71724155462",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "0952d987-0179-4baf-bb1d-3dc8b244ef09",
            "latches": []
        },
        {
            "id": "file",
            "instance": "498fda9e-66c9-48e7-8b3a-32e96c830033",
            "properties": [
                [
                    "name",
                    "spinstall0.aspx"
                ],
                [
                    "name_enc",
                    null
                ],
                [
                    "size",
                    null
                ],
                [
                    "hashes",
                    []
                ],
                [
                    "magic_number_hex",
                    null
                ],
                [
                    "mime_type",
                    null
                ],
                [
                    "ctime",
                    null
                ],
                [
                    "mtime",
                    null
                ],
                [
                    "atime",
                    null
                ]
            ],
            "anchors": {
                "0": "1e26129d-c48d-484c-8f75-265d899107c9",
                "30": "2df3186b-c4c6-4898-bfe3-c9d604df9543",
                "60": "580fb70e-e52b-4e62-91d3-3b0becd4292b",
                "90": "6d776c83-2616-464f-87a1-5e73f12bb7be",
                "120": "24c6d765-8f83-4b9f-a9ef-d2718005ea8e",
                "150": "da38caa8-9739-4954-b97f-0445d2a017e6",
                "180": "d788c5ea-ac75-4664-a5cb-7a17ea06a85a",
                "210": "6f54e912-2cd6-414c-b4a2-bf517625df5b",
                "240": "b14d5e5c-80ae-487c-9201-4865d3ccd0db",
                "270": "b2c72978-3649-42db-9d54-bce3861a5f25",
                "300": "8586751f-682f-43b6-927f-0f0197c80a67",
                "330": "bef44cee-1c1c-4984-b7e2-c4ccbcaa6c17"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "1e26129d-c48d-484c-8f75-265d899107c9",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "2df3186b-c4c6-4898-bfe3-c9d604df9543",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "580fb70e-e52b-4e62-91d3-3b0becd4292b",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6d776c83-2616-464f-87a1-5e73f12bb7be",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "24c6d765-8f83-4b9f-a9ef-d2718005ea8e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "da38caa8-9739-4954-b97f-0445d2a017e6",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "d788c5ea-ac75-4664-a5cb-7a17ea06a85a",
            "latches": [
                "0043ff78-cd71-4a4b-b00b-b133face2160"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "6f54e912-2cd6-414c-b4a2-bf517625df5b",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b14d5e5c-80ae-487c-9201-4865d3ccd0db",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b2c72978-3649-42db-9d54-bce3861a5f25",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "8586751f-682f-43b6-927f-0f0197c80a67",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "bef44cee-1c1c-4984-b7e2-c4ccbcaa6c17",
            "latches": []
        },
        {
            "id": "action",
            "instance": "e5000cc6-e025-44ff-9d81-513ad0cbbf86",
            "properties": [
                [
                    "name",
                    "Unsecured Credentials"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0006"
                        ],
                        [
                            "technique",
                            "T1552"
                        ]
                    ]
                ],
                [
                    "description",
                    "The web shell extracts the MachineKey from memory."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "fbf0658f-f8d0-485b-b1a1-ed6e83236258",
                "30": "7d679c1f-46c7-4922-ac41-66ee3902277d",
                "60": "646abce0-6f6c-4918-9cd5-3172f2752963",
                "90": "e4e755aa-c7f5-48ef-b28a-8b25f76bb959",
                "120": "9214bfb2-32ae-408a-a74f-d113f382e71f",
                "150": "8f953123-e9b0-4b87-9322-8b0b53c59a69",
                "180": "22878301-83f7-4c53-b9d7-d2758e01dd4f",
                "210": "7754d0ba-ed64-45ae-aa42-58d7f0bc83a2",
                "240": "7f415f95-68b3-4705-9ef8-660576ffad37",
                "270": "f642d476-bd2a-421f-92dc-c0b258fc999b",
                "300": "95178f2e-6a5f-4fca-bd2f-e7b16c774f02",
                "330": "761bb88c-1355-4f13-b027-73383d870a49"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "fbf0658f-f8d0-485b-b1a1-ed6e83236258",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "7d679c1f-46c7-4922-ac41-66ee3902277d",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "646abce0-6f6c-4918-9cd5-3172f2752963",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e4e755aa-c7f5-48ef-b28a-8b25f76bb959",
            "latches": [
                "2fa8daf6-6d18-4ef9-9cfe-3a4894b641bf"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "9214bfb2-32ae-408a-a74f-d113f382e71f",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "8f953123-e9b0-4b87-9322-8b0b53c59a69",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "22878301-83f7-4c53-b9d7-d2758e01dd4f",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "7754d0ba-ed64-45ae-aa42-58d7f0bc83a2",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "7f415f95-68b3-4705-9ef8-660576ffad37",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "f642d476-bd2a-421f-92dc-c0b258fc999b",
            "latches": [
                "8160fdd0-6cd2-4572-abae-156c3313e39b"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "95178f2e-6a5f-4fca-bd2f-e7b16c774f02",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "761bb88c-1355-4f13-b027-73383d870a49",
            "latches": []
        },
        {
            "id": "action",
            "instance": "569b8f7c-59f2-4df3-9fd9-f8c268130cd9",
            "properties": [
                [
                    "name",
                    "Reflective Code Loading"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0005"
                        ],
                        [
                            "technique",
                            "T1620"
                        ]
                    ]
                ],
                [
                    "description",
                    "The web shell uses reflection to access the web configuration from memory."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "27875be6-199f-4714-8903-c09100505589",
                "30": "2bb61824-147a-40b7-ab25-d37bffe709ac",
                "60": "c90339f3-aa52-4958-a1d0-428d78e3c2f5",
                "90": "e0bef300-2f36-45ca-b99c-ce68a537f43d",
                "120": "585ba24c-2931-4752-9676-17302e3c7ee7",
                "150": "b29b023f-bbdb-4c02-841d-279c3843b994",
                "180": "6c694d1d-6bee-493d-bf77-a7dfb2c7e131",
                "210": "517047db-61f5-4d12-a607-eb4c5c4c547c",
                "240": "9a3b74c5-996c-4add-8df9-1ec147df09ad",
                "270": "7a8fa297-361d-4c3c-9392-8a5696efcc07",
                "300": "3d46b14b-e2a9-4eba-ad2f-fb6faac21f64",
                "330": "677bd19c-cf94-4bcd-836a-b1a19c4f649a"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "27875be6-199f-4714-8903-c09100505589",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "2bb61824-147a-40b7-ab25-d37bffe709ac",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "c90339f3-aa52-4958-a1d0-428d78e3c2f5",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e0bef300-2f36-45ca-b99c-ce68a537f43d",
            "latches": [
                "e1b7fead-64e9-467e-a408-a902a189d791"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "585ba24c-2931-4752-9676-17302e3c7ee7",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "b29b023f-bbdb-4c02-841d-279c3843b994",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "6c694d1d-6bee-493d-bf77-a7dfb2c7e131",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "517047db-61f5-4d12-a607-eb4c5c4c547c",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9a3b74c5-996c-4add-8df9-1ec147df09ad",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "7a8fa297-361d-4c3c-9392-8a5696efcc07",
            "latches": [
                "bc963dd5-559a-4aba-8bb1-f3457eab08c4"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "3d46b14b-e2a9-4eba-ad2f-fb6faac21f64",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "677bd19c-cf94-4bcd-836a-b1a19c4f649a",
            "latches": []
        },
        {
            "id": "ipv4_addr",
            "instance": "57890b7f-d16b-49a7-bc5d-fd5b68e2eee0",
            "properties": [
                [
                    "value",
                    "107.191.58.76"
                ]
            ],
            "anchors": {
                "0": "968c8c59-7268-410a-9099-80b39d84d975",
                "30": "9d2bc304-8b7c-4e84-ac97-3c2fbf5a6aa6",
                "60": "0a63d555-3142-4d58-abb8-e3b5d17e1e3e",
                "90": "0c45ed59-95b1-4c3c-9029-0ba0a41e3558",
                "120": "8dcb7f69-70c6-42a2-9f18-27c6a7fa2de0",
                "150": "bf4e141b-0965-45ba-ae6d-57778c544703",
                "180": "f59a628c-918b-4fda-ab14-97f5b98296a9",
                "210": "3613d4f4-d03b-4faf-96a5-53625d3ea881",
                "240": "aed2a0b9-22ba-4e6a-bfbe-0932e068ab63",
                "270": "bef37aeb-da1e-4164-8cb5-4feb1d3e9f8e",
                "300": "b6a4140b-0832-4ac9-8886-92dc0b5e1f28",
                "330": "3f1a5264-47af-48cc-9f80-bc8579d7dcce"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "968c8c59-7268-410a-9099-80b39d84d975",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "9d2bc304-8b7c-4e84-ac97-3c2fbf5a6aa6",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0a63d555-3142-4d58-abb8-e3b5d17e1e3e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0c45ed59-95b1-4c3c-9029-0ba0a41e3558",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "8dcb7f69-70c6-42a2-9f18-27c6a7fa2de0",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "bf4e141b-0965-45ba-ae6d-57778c544703",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "f59a628c-918b-4fda-ab14-97f5b98296a9",
            "latches": [
                "02e7133a-8e95-4b5a-bd9d-5b8ba9ce60dc"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "3613d4f4-d03b-4faf-96a5-53625d3ea881",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "aed2a0b9-22ba-4e6a-bfbe-0932e068ab63",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "bef37aeb-da1e-4164-8cb5-4feb1d3e9f8e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b6a4140b-0832-4ac9-8886-92dc0b5e1f28",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "3f1a5264-47af-48cc-9f80-bc8579d7dcce",
            "latches": []
        },
        {
            "id": "ipv4_addr",
            "instance": "05262d6e-2758-46f6-8061-2e46d7003b6d",
            "properties": [
                [
                    "value",
                    "104.238.159.149"
                ]
            ],
            "anchors": {
                "0": "9f45d504-ec4f-4f13-8b3b-649f5ae56802",
                "30": "cb4c5b71-a583-4ea3-b0de-74a025f878cf",
                "60": "0b2bc7cf-9d7f-4b14-93a2-5c4f898c3a66",
                "90": "945daa85-c37f-4976-88f8-ec805402abce",
                "120": "9ba2fecc-db34-42fd-96e1-4e07c2e6c216",
                "150": "1312ced7-72ac-4003-bcc0-2eaf45015bff",
                "180": "ad5ca85d-127a-4614-80f3-dd5fed434abe",
                "210": "9b5d1441-cbf0-4c71-8523-f1137d86e4d0",
                "240": "647212a7-ad38-4718-9e01-6884db10b272",
                "270": "50986ebe-43df-40ab-9b44-e16f56bc5457",
                "300": "f86cd31d-73a2-44a0-8180-66ebc7a51a49",
                "330": "0a2351c8-dbd9-4b26-9565-2ca34bbeb0d1"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "9f45d504-ec4f-4f13-8b3b-649f5ae56802",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "cb4c5b71-a583-4ea3-b0de-74a025f878cf",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0b2bc7cf-9d7f-4b14-93a2-5c4f898c3a66",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "945daa85-c37f-4976-88f8-ec805402abce",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9ba2fecc-db34-42fd-96e1-4e07c2e6c216",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1312ced7-72ac-4003-bcc0-2eaf45015bff",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "ad5ca85d-127a-4614-80f3-dd5fed434abe",
            "latches": [
                "97484ada-e666-469b-b3a7-0bce737f275d"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "9b5d1441-cbf0-4c71-8523-f1137d86e4d0",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "647212a7-ad38-4718-9e01-6884db10b272",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "50986ebe-43df-40ab-9b44-e16f56bc5457",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "f86cd31d-73a2-44a0-8180-66ebc7a51a49",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "0a2351c8-dbd9-4b26-9565-2ca34bbeb0d1",
            "latches": []
        },
        {
            "id": "ipv4_addr",
            "instance": "777dd3e3-48a8-4d7a-9002-aa19fdc07aa7",
            "properties": [
                [
                    "value",
                    "96.9.125.147"
                ]
            ],
            "anchors": {
                "0": "5bfd890e-254b-4191-be35-740eb8aec0d7",
                "30": "2492801e-1382-4320-8f1e-e1d7c993a283",
                "60": "b33fe0e3-7058-4c0b-840b-a72d6d4d2ed1",
                "90": "d0d5bcc1-6d16-43ee-be3e-880a85a27e70",
                "120": "d5c2ae5c-efbe-492a-8a49-623da93307e0",
                "150": "d19544cd-e8b2-4255-a52e-54e82132a306",
                "180": "40d17951-1504-49c1-af26-581dab41d080",
                "210": "febb790c-57e7-4aee-8790-e0c2166b637b",
                "240": "be450f8b-e14b-47db-b70c-a6e52f2ea126",
                "270": "0b32616a-7c9f-4d68-9401-621517caea3e",
                "300": "58b8b624-f636-43cd-ad78-9bf2ba12b95a",
                "330": "992ec211-1a84-454b-8c6c-4740a003d333"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "5bfd890e-254b-4191-be35-740eb8aec0d7",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "2492801e-1382-4320-8f1e-e1d7c993a283",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b33fe0e3-7058-4c0b-840b-a72d6d4d2ed1",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "d0d5bcc1-6d16-43ee-be3e-880a85a27e70",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "d5c2ae5c-efbe-492a-8a49-623da93307e0",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "d19544cd-e8b2-4255-a52e-54e82132a306",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "40d17951-1504-49c1-af26-581dab41d080",
            "latches": [
                "2d4f855c-925a-4a34-bf1c-0753244ce47e"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "febb790c-57e7-4aee-8790-e0c2166b637b",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "be450f8b-e14b-47db-b70c-a6e52f2ea126",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0b32616a-7c9f-4d68-9401-621517caea3e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "58b8b624-f636-43cd-ad78-9bf2ba12b95a",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "992ec211-1a84-454b-8c6c-4740a003d333",
            "latches": []
        },
        {
            "id": "domain_name",
            "instance": "3d049b16-d78d-4fd8-b2a4-91a7d159e827",
            "properties": [
                [
                    "value",
                    "dynastyjusticecollective.site"
                ]
            ],
            "anchors": {
                "0": "cf4c0518-545a-4b75-aade-036a17393388",
                "30": "ab6dd47d-4063-4d4d-97d0-849a0d97b283",
                "60": "1e3c9f68-1989-4f3e-ab0c-3ce837377436",
                "90": "5c439d67-f28e-4184-a10a-9c34b20519ce",
                "120": "8ae4e84e-27e1-4d50-9946-877a5d376cd7",
                "150": "c4dad9ea-d428-4d3f-a9d9-f7ad0ccbfcaf",
                "180": "49c116af-570b-48f1-bcb9-61c77e804836",
                "210": "113e0e6d-d0d0-4569-bcdd-f427476caf6e",
                "240": "eb77979c-e40c-415b-9a75-9297e07bae64",
                "270": "13b8fc6b-7306-4c91-9aa5-3876ede05107",
                "300": "350349e9-1d4b-49ce-b35b-98bc1c053e2e",
                "330": "1edc5038-de1c-4da1-9d13-417c7276e3f9"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "cf4c0518-545a-4b75-aade-036a17393388",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "ab6dd47d-4063-4d4d-97d0-849a0d97b283",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "1e3c9f68-1989-4f3e-ab0c-3ce837377436",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "5c439d67-f28e-4184-a10a-9c34b20519ce",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "8ae4e84e-27e1-4d50-9946-877a5d376cd7",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "c4dad9ea-d428-4d3f-a9d9-f7ad0ccbfcaf",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "49c116af-570b-48f1-bcb9-61c77e804836",
            "latches": [
                "b527e71f-15a8-4d20-a299-eff251a33190"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "113e0e6d-d0d0-4569-bcdd-f427476caf6e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "eb77979c-e40c-415b-9a75-9297e07bae64",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "13b8fc6b-7306-4c91-9aa5-3876ede05107",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "350349e9-1d4b-49ce-b35b-98bc1c053e2e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1edc5038-de1c-4da1-9d13-417c7276e3f9",
            "latches": []
        },
        {
            "id": "action",
            "instance": "d2dada60-cc73-4b2d-b652-84a9104bcb37",
            "properties": [
                [
                    "name",
                    "Exfiltration Over C2 Channel"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0010"
                        ],
                        [
                            "technique",
                            "T1041"
                        ]
                    ]
                ],
                [
                    "description",
                    "The attacker exfiltrates the MachineKey through the the web shell."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "eb8c1440-18bd-4d7a-a4b8-c78caa2eb1bc",
                "30": "75496fea-c75e-414a-aee7-8beadb479a96",
                "60": "d188925d-a3a1-4f1d-9c2c-497ded6e825c",
                "90": "115a6196-c0b7-42fe-ad9a-fd816ad78c07",
                "120": "21079f61-5c38-4b4e-9398-f49e6b3b7f4e",
                "150": "636a8de2-fa7d-48e4-b740-c636e69ee2ca",
                "180": "3ebf1b75-5ff6-42f2-b9cd-c573e2761f01",
                "210": "ebecaddd-1075-469e-9806-7292f9407c3e",
                "240": "ac30b6d7-69a7-4ce2-8164-bf3699a126b1",
                "270": "f3dc88ad-3ddc-44f4-97bb-103db941d870",
                "300": "2c309617-cff4-46c3-8113-3000c40fb1df",
                "330": "858c8059-f81a-4554-b536-6ccff9402757"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "eb8c1440-18bd-4d7a-a4b8-c78caa2eb1bc",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "75496fea-c75e-414a-aee7-8beadb479a96",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "d188925d-a3a1-4f1d-9c2c-497ded6e825c",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "115a6196-c0b7-42fe-ad9a-fd816ad78c07",
            "latches": [
                "387f32a8-ec1b-47e2-9afe-8574223cdcc2"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "21079f61-5c38-4b4e-9398-f49e6b3b7f4e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "636a8de2-fa7d-48e4-b740-c636e69ee2ca",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "3ebf1b75-5ff6-42f2-b9cd-c573e2761f01",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "ebecaddd-1075-469e-9806-7292f9407c3e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "ac30b6d7-69a7-4ce2-8164-bf3699a126b1",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "f3dc88ad-3ddc-44f4-97bb-103db941d870",
            "latches": [
                "d7e9f9e6-8410-4e2e-97a9-70ae07b1f6a8"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "2c309617-cff4-46c3-8113-3000c40fb1df",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "858c8059-f81a-4554-b536-6ccff9402757",
            "latches": []
        },
        {
            "id": "note",
            "instance": "845e5642-6ed8-4403-864e-6234ef03209c",
            "properties": [
                [
                    "abstract",
                    "Unit42 Variant 1"
                ],
                [
                    "content",
                    "This attack path shows the post-exploitation behavior observed in the Unit 42 report labeled \"Variation 1\"."
                ],
                [
                    "authors",
                    []
                ]
            ],
            "anchors": {
                "0": "c811fa06-79e0-4f1a-8f70-c467ca7655dc",
                "30": "8bc28682-c383-4d39-bbac-dd74993ff844",
                "60": "97adbacb-a8d1-42e9-a4f9-82a4b64f0e0e",
                "90": "36a7dadc-e015-45bb-94d2-96f4cafe07f2",
                "120": "6ceece36-2ce5-45ce-9779-522eff00da5a",
                "150": "c0e49010-4060-46aa-a105-a2419e1589e8",
                "180": "1818546b-53ec-486e-9c01-50c54889eb51",
                "210": "283d9cd5-940a-40f3-aedc-5cff48fdb4c3",
                "240": "220bb35a-caf6-4665-8ece-1aaa00f79489",
                "270": "9fe444c7-6c31-4486-913b-f152b88fd9a6",
                "300": "870c8bce-8636-4d28-949d-a5ed954db661",
                "330": "1567b316-75cd-4b79-bacb-39a8381cd018"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "c811fa06-79e0-4f1a-8f70-c467ca7655dc",
            "latches": [
                "4eb509c7-8014-4f7c-bb39-92c6a682879b"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "8bc28682-c383-4d39-bbac-dd74993ff844",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "97adbacb-a8d1-42e9-a4f9-82a4b64f0e0e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "36a7dadc-e015-45bb-94d2-96f4cafe07f2",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6ceece36-2ce5-45ce-9779-522eff00da5a",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "c0e49010-4060-46aa-a105-a2419e1589e8",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1818546b-53ec-486e-9c01-50c54889eb51",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "283d9cd5-940a-40f3-aedc-5cff48fdb4c3",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "220bb35a-caf6-4665-8ece-1aaa00f79489",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9fe444c7-6c31-4486-913b-f152b88fd9a6",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "870c8bce-8636-4d28-949d-a5ed954db661",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1567b316-75cd-4b79-bacb-39a8381cd018",
            "latches": []
        },
        {
            "id": "action",
            "instance": "008353db-6512-4d03-aeea-0bd065ed0a97",
            "properties": [
                [
                    "name",
                    "Automated Collection"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0009"
                        ],
                        [
                            "technique",
                            "T1119"
                        ]
                    ]
                ],
                [
                    "description",
                    "The payload iterates over the webroot recursively looking for web.config files and extracting their contents."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "56cb7aad-ae14-4cc0-a244-0c64dcfff5b6",
                "30": "d765e7f3-3b14-4fc7-9cbb-0ab1fbbb8400",
                "60": "6e730a8b-a59f-4b12-84e4-0bb89cb01ec4",
                "90": "4e55ee9c-a6b5-41e6-acb5-74e9b19a9936",
                "120": "44b414dd-c676-4e5c-a32d-8ffd19b50ed2",
                "150": "0c975b25-5f14-4337-9555-42aca7b05951",
                "180": "7b00463f-676e-4adb-bdc2-f7a0c71131af",
                "210": "7a2f6213-af9b-481e-b9c5-1f3131bd8415",
                "240": "b34639fc-fcd7-41a1-8dce-4f25bb8773db",
                "270": "36b4f72b-7c26-49cc-a50a-c9bb8ba7f091",
                "300": "fc97850e-3009-4928-94bd-aaef5591ae3b",
                "330": "2822f305-0cc2-4e87-a4fe-746678530fc1"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "56cb7aad-ae14-4cc0-a244-0c64dcfff5b6",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "d765e7f3-3b14-4fc7-9cbb-0ab1fbbb8400",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6e730a8b-a59f-4b12-84e4-0bb89cb01ec4",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "4e55ee9c-a6b5-41e6-acb5-74e9b19a9936",
            "latches": [
                "2732f9f7-f352-4a9c-9182-3eee2fba4f28"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "44b414dd-c676-4e5c-a32d-8ffd19b50ed2",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "0c975b25-5f14-4337-9555-42aca7b05951",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "7b00463f-676e-4adb-bdc2-f7a0c71131af",
            "latches": [
                "729c7f42-acf4-4c45-8070-e2858ae1742d"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "7a2f6213-af9b-481e-b9c5-1f3131bd8415",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b34639fc-fcd7-41a1-8dce-4f25bb8773db",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "36b4f72b-7c26-49cc-a50a-c9bb8ba7f091",
            "latches": [
                "053f6341-be64-43e2-b7a1-1c4772958e93"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "fc97850e-3009-4928-94bd-aaef5591ae3b",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "2822f305-0cc2-4e87-a4fe-746678530fc1",
            "latches": []
        },
        {
            "id": "action",
            "instance": "f3f53445-df65-439e-8d00-6798a6ae52c7",
            "properties": [
                [
                    "name",
                    "Local Data Staging"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0009"
                        ],
                        [
                            "technique",
                            "T1074.001"
                        ]
                    ]
                ],
                [
                    "description",
                    "The contents of web.config files are staged in a new file called debug_dev.js."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "19927756-afb8-470e-ac27-3a560a2d3803",
                "30": "045d42b3-13ba-4a78-b447-ac4443bce8cd",
                "60": "e7b8e903-59f0-496e-ad2d-5684d07182b0",
                "90": "c2843485-512a-44f1-9b1e-b5d480604cb3",
                "120": "15d82600-ed68-4edb-91c4-2123aef4fd3e",
                "150": "d36ab674-e328-4149-84b6-0a746d49a9a9",
                "180": "b34185d8-7901-4f8b-bbbb-d8ae2624d8fb",
                "210": "e5d4055d-d7ad-4677-bb0a-d0dcfc6635f0",
                "240": "7f2b67c3-3247-4b73-ad5c-2ebb8169798f",
                "270": "e28094e6-c054-4e33-991d-d54003535046",
                "300": "abb828c0-4a6a-46f7-bb4f-3d0444224704",
                "330": "960f5761-a0ec-4666-9ce6-24eb9904e6ee"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "19927756-afb8-470e-ac27-3a560a2d3803",
            "latches": [
                "19c42fa9-0820-4682-a6ff-cefc6f86120a"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "045d42b3-13ba-4a78-b447-ac4443bce8cd",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e7b8e903-59f0-496e-ad2d-5684d07182b0",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "c2843485-512a-44f1-9b1e-b5d480604cb3",
            "latches": [
                "e2dc25f6-155b-49aa-927e-cabfa88066e8"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "15d82600-ed68-4edb-91c4-2123aef4fd3e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "d36ab674-e328-4149-84b6-0a746d49a9a9",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "b34185d8-7901-4f8b-bbbb-d8ae2624d8fb",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "e5d4055d-d7ad-4677-bb0a-d0dcfc6635f0",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "7f2b67c3-3247-4b73-ad5c-2ebb8169798f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e28094e6-c054-4e33-991d-d54003535046",
            "latches": [
                "28c21edd-05f5-4f3c-9bd6-41aef53bf0c8"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "abb828c0-4a6a-46f7-bb4f-3d0444224704",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "960f5761-a0ec-4666-9ce6-24eb9904e6ee",
            "latches": []
        },
        {
            "id": "file",
            "instance": "637a45fa-407f-41c3-994a-536860d4bf3f",
            "properties": [
                [
                    "name",
                    "\\PROGRA~1\\COMMON~1\\MICROS~1\\WEBSER~1\\16\\TEMPLATE\\LAYOUTS\\debug_dev.js"
                ],
                [
                    "name_enc",
                    null
                ],
                [
                    "size",
                    null
                ],
                [
                    "hashes",
                    []
                ],
                [
                    "magic_number_hex",
                    null
                ],
                [
                    "mime_type",
                    null
                ],
                [
                    "ctime",
                    null
                ],
                [
                    "mtime",
                    null
                ],
                [
                    "atime",
                    null
                ]
            ],
            "anchors": {
                "0": "e3f21ceb-ace3-411b-ad98-373cfae7bed7",
                "30": "bc4bb0bc-5504-424b-8a7f-cefd3a0cc3c6",
                "60": "b724d231-5ba1-479f-a981-dc9c8cf8698f",
                "90": "5e12bbda-e176-4fca-af59-e775b37d4127",
                "120": "e4fdd0a7-f9e2-49db-b637-dc3bf52c6d04",
                "150": "ce7f32d5-3e31-4f42-8ed0-1bbfdd73f3d7",
                "180": "f442a9c2-2ee9-432d-8f2b-fd01da75cca4",
                "210": "df925182-05b1-4f20-bc0b-6e833daa82db",
                "240": "e6f37537-9b20-4614-b2d5-14b51207b059",
                "270": "3ee42a8f-a811-4aea-a6be-d6c55004449f",
                "300": "3bfc8fa2-3f2f-4928-a088-366882725053",
                "330": "deabb29d-4984-4f68-8e46-fe02b0771af6"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "e3f21ceb-ace3-411b-ad98-373cfae7bed7",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "bc4bb0bc-5504-424b-8a7f-cefd3a0cc3c6",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b724d231-5ba1-479f-a981-dc9c8cf8698f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "5e12bbda-e176-4fca-af59-e775b37d4127",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e4fdd0a7-f9e2-49db-b637-dc3bf52c6d04",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "ce7f32d5-3e31-4f42-8ed0-1bbfdd73f3d7",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "f442a9c2-2ee9-432d-8f2b-fd01da75cca4",
            "latches": [
                "d1238e21-f4a2-43d3-a14d-021909d7b3a2"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "df925182-05b1-4f20-bc0b-6e833daa82db",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "e6f37537-9b20-4614-b2d5-14b51207b059",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "3ee42a8f-a811-4aea-a6be-d6c55004449f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "3bfc8fa2-3f2f-4928-a088-366882725053",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "deabb29d-4984-4f68-8e46-fe02b0771af6",
            "latches": []
        },
        {
            "id": "action",
            "instance": "54f36148-bba7-4a97-aaa5-8493be71ef0d",
            "properties": [
                [
                    "name",
                    "Obfuscated Files or Information"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0005"
                        ],
                        [
                            "technique",
                            "T1027"
                        ]
                    ]
                ],
                [
                    "description",
                    "The Powershell payload is base64 encoded."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "bd70ce7f-7bab-4f37-860b-3df3f86c382e",
                "30": "a3fd9318-273e-47a1-9f54-1b48d24de309",
                "60": "2a0de050-95b9-46b5-84ca-5d1ef2d34132",
                "90": "ff72f2cb-46aa-431e-92c4-892d950d9e89",
                "120": "e7723004-8484-41e5-8edc-aca8fde98f2b",
                "150": "bb936d78-b7f7-40c4-8ec3-0290634fb264",
                "180": "80420669-b618-4176-a2b6-b233b3ac92aa",
                "210": "b435a64c-a475-43e9-8fb8-420aaa170d59",
                "240": "9525e613-4ed5-4e23-a4b4-9349d0b012be",
                "270": "329eb8a6-8b7b-4fb0-b7b3-3872a2ea2983",
                "300": "361460cf-afe8-46ff-80e8-e8580dbb2662",
                "330": "215c21d2-adf0-4536-aeee-2449f477d570"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "bd70ce7f-7bab-4f37-860b-3df3f86c382e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "a3fd9318-273e-47a1-9f54-1b48d24de309",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "2a0de050-95b9-46b5-84ca-5d1ef2d34132",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "ff72f2cb-46aa-431e-92c4-892d950d9e89",
            "latches": [
                "d3797833-95e0-414b-baff-f5a0acab218a"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "e7723004-8484-41e5-8edc-aca8fde98f2b",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "bb936d78-b7f7-40c4-8ec3-0290634fb264",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "80420669-b618-4176-a2b6-b233b3ac92aa",
            "latches": [
                "0bc7d138-2007-4fe9-a5a6-2868fc885a5f"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "b435a64c-a475-43e9-8fb8-420aaa170d59",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9525e613-4ed5-4e23-a4b4-9349d0b012be",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "329eb8a6-8b7b-4fb0-b7b3-3872a2ea2983",
            "latches": [
                "a295e2be-595f-483d-9ff5-2827c1f4a59e"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "361460cf-afe8-46ff-80e8-e8580dbb2662",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "215c21d2-adf0-4536-aeee-2449f477d570",
            "latches": []
        },
        {
            "id": "action",
            "instance": "0b2518af-d570-43f3-b1c6-90988a96ace8",
            "properties": [
                [
                    "name",
                    "Exfiltration Over C2 Channel"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0010"
                        ],
                        [
                            "technique",
                            "T1041"
                        ]
                    ]
                ],
                [
                    "description",
                    "The adversary exfiltrates the staged data over HTTP."
                ],
                [
                    "confidence",
                    "speculative"
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "cef86318-0b61-4415-b253-27040165e592",
                "30": "585cab81-f30d-4d8a-a9c3-8c752a378004",
                "60": "d3e13e91-b7a7-475e-a885-efddd47cfd67",
                "90": "6b786cf9-123e-42c4-b193-b50a87d0900e",
                "120": "d63502f6-b97d-4774-8cf7-bdaf88d6a957",
                "150": "914b4af6-e91c-4065-9e1d-65ba8f03edab",
                "180": "33c84bc8-920b-43bd-99c2-f79b566328cd",
                "210": "7be4702d-3618-4b96-b5b8-c29ffe892080",
                "240": "9cafa1f3-0cb4-4819-8091-8a8468ea312f",
                "270": "3c57cf72-81a9-438e-9450-dce386d8d0f2",
                "300": "f6f3640b-1b97-46df-b3cf-f2f686ee5c91",
                "330": "e05f2a76-19b8-4ae2-819b-7c368ea24266"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "cef86318-0b61-4415-b253-27040165e592",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "585cab81-f30d-4d8a-a9c3-8c752a378004",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "d3e13e91-b7a7-475e-a885-efddd47cfd67",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6b786cf9-123e-42c4-b193-b50a87d0900e",
            "latches": [
                "e238f82d-92a9-4e61-aabd-b3b096f28682"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "d63502f6-b97d-4774-8cf7-bdaf88d6a957",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "914b4af6-e91c-4065-9e1d-65ba8f03edab",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "33c84bc8-920b-43bd-99c2-f79b566328cd",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "7be4702d-3618-4b96-b5b8-c29ffe892080",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9cafa1f3-0cb4-4819-8091-8a8468ea312f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "3c57cf72-81a9-438e-9450-dce386d8d0f2",
            "latches": [
                "6a3765f7-5a69-445e-bb15-612afd6577f7"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "f6f3640b-1b97-46df-b3cf-f2f686ee5c91",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "e05f2a76-19b8-4ae2-819b-7c368ea24266",
            "latches": []
        },
        {
            "id": "note",
            "instance": "9f90fa81-aa0e-4caa-b754-e33d491b56c1",
            "properties": [
                [
                    "abstract",
                    "Unit42 Variant 3"
                ],
                [
                    "content",
                    "This attack path shows the post-exploitation behavior observed in the Unit 42 report labeled \"Variation 3\"."
                ],
                [
                    "authors",
                    []
                ]
            ],
            "anchors": {
                "0": "a1705a7e-3805-42fe-a804-719a923546f7",
                "30": "4a8d9b42-8870-4342-8dff-980e97e6a433",
                "60": "93f69bb5-0bf4-4dd1-bb4a-4f44dde0048f",
                "90": "62da864f-5899-46c3-bee5-22fb55688d18",
                "120": "4196ca2e-d6b9-4432-9249-b18069726122",
                "150": "26f50343-8c83-4fb5-97b7-d90285f09d75",
                "180": "1af4c455-0f9e-4d01-8d3e-c2320ddd6307",
                "210": "128e6a33-8382-42d2-bd01-8b0a009e6910",
                "240": "a5f1f99b-3df0-4d30-8c09-0beb15528959",
                "270": "9b2dad7a-dc5d-4156-9891-3a0f00caad38",
                "300": "11c6fdbb-cbdf-483d-8951-27546a89ad53",
                "330": "71d88dc1-56c4-48e8-8c3e-0e5ab4bd4d86"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "a1705a7e-3805-42fe-a804-719a923546f7",
            "latches": [
                "c2cb75ba-a4b3-4328-be93-a2d90c76285a"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "4a8d9b42-8870-4342-8dff-980e97e6a433",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "93f69bb5-0bf4-4dd1-bb4a-4f44dde0048f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "62da864f-5899-46c3-bee5-22fb55688d18",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "4196ca2e-d6b9-4432-9249-b18069726122",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "26f50343-8c83-4fb5-97b7-d90285f09d75",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1af4c455-0f9e-4d01-8d3e-c2320ddd6307",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "128e6a33-8382-42d2-bd01-8b0a009e6910",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "a5f1f99b-3df0-4d30-8c09-0beb15528959",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9b2dad7a-dc5d-4156-9891-3a0f00caad38",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "11c6fdbb-cbdf-483d-8951-27546a89ad53",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "71d88dc1-56c4-48e8-8c3e-0e5ab4bd4d86",
            "latches": []
        },
        {
            "id": "action",
            "instance": "3e5ecd65-6165-4dfb-9642-2b49ce2e80a1",
            "properties": [
                [
                    "name",
                    "ViewState Persistence"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0003"
                        ],
                        [
                            "technique",
                            null
                        ]
                    ]
                ],
                [
                    "description",
                    "The attacker uses the stolen MachineKey to forge the ASP.NET VIEWSTATE, which allows code execution even after the CVEs are patched and the web shells are removed."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "78fed8d2-ec70-4a23-9b4e-0f72d09ce847",
                "30": "1ce3e86c-0315-48a4-884c-70b291f7d099",
                "60": "87ee9de8-9c25-49be-b01b-40882c450508",
                "90": "237955ca-d132-453d-af16-9d0cb3091a4a",
                "120": "18a1f441-1f03-408a-8287-1d838d3605af",
                "150": "aae3bc05-4489-4194-b23d-4c9c036330d4",
                "180": "1ff1eb81-b796-4a66-8ec9-80d0f6596915",
                "210": "4e523f2c-4bae-49bd-b085-b3c14d0061fb",
                "240": "b9f16f8f-09c8-4e7c-8875-e643e60a7375",
                "270": "f56b0a65-ed25-495e-a558-3361139be04b",
                "300": "2e26d85c-7e6e-46bc-ab71-6fecc40da7f0",
                "330": "0e9e0a50-4def-4b85-a856-d691d88698f2"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "78fed8d2-ec70-4a23-9b4e-0f72d09ce847",
            "latches": [
                "b74b236b-e97a-4691-a430-79ace2a40c6c"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "1ce3e86c-0315-48a4-884c-70b291f7d099",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "87ee9de8-9c25-49be-b01b-40882c450508",
            "latches": [
                "3b36d723-f769-4ebc-95fb-3e4d944b20ee"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "237955ca-d132-453d-af16-9d0cb3091a4a",
            "latches": [
                "b7e72eb5-ba82-464e-8486-e09a88caf7fd"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "18a1f441-1f03-408a-8287-1d838d3605af",
            "latches": [
                "80d93c71-717e-48bb-a0dc-da673499b980"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "aae3bc05-4489-4194-b23d-4c9c036330d4",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1ff1eb81-b796-4a66-8ec9-80d0f6596915",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "4e523f2c-4bae-49bd-b085-b3c14d0061fb",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "b9f16f8f-09c8-4e7c-8875-e643e60a7375",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "f56b0a65-ed25-495e-a558-3361139be04b",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "2e26d85c-7e6e-46bc-ab71-6fecc40da7f0",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "0e9e0a50-4def-4b85-a856-d691d88698f2",
            "latches": []
        },
        {
            "id": "file",
            "instance": "5ecca340-5fd5-45f9-acb5-136cbe15dac8",
            "properties": [
                [
                    "name",
                    "\\PROGRA~1\\COMMON~1\\MICROS~1\\WEBSER~1\\16\\TEMPLATE\\LAYOUTS\\spinstall0.aspx"
                ],
                [
                    "name_enc",
                    null
                ],
                [
                    "size",
                    null
                ],
                [
                    "hashes",
                    []
                ],
                [
                    "magic_number_hex",
                    null
                ],
                [
                    "mime_type",
                    null
                ],
                [
                    "ctime",
                    null
                ],
                [
                    "mtime",
                    null
                ],
                [
                    "atime",
                    null
                ]
            ],
            "anchors": {
                "0": "e0e81dbb-18f1-46f3-b2eb-e6e91f90442f",
                "30": "7b038973-3fbc-47c2-9551-1bc9a01710fa",
                "60": "9dc80c51-5f9d-477d-b443-ab1d605de799",
                "90": "0db2991c-3c4b-43f5-b842-78cee4f31096",
                "120": "3f27ee49-420e-4659-af1e-849dbac96cce",
                "150": "650753f1-fec2-440e-978c-4eb472eb3c25",
                "180": "9bd7b8ed-0c92-41a5-9f01-ffa37b319a5e",
                "210": "ec2bd4ce-7482-4b9d-a849-251ba616da0e",
                "240": "ed189895-7259-4fc5-8c6c-141f4c73b28f",
                "270": "65260ef3-ae80-4120-b569-56c92abe7fb9",
                "300": "6f5e7a28-82cf-479a-bc32-f2d9c5fa56c2",
                "330": "8cf690a3-4524-4e4e-9dfd-f30f997d9cfd"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "e0e81dbb-18f1-46f3-b2eb-e6e91f90442f",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "7b038973-3fbc-47c2-9551-1bc9a01710fa",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9dc80c51-5f9d-477d-b443-ab1d605de799",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0db2991c-3c4b-43f5-b842-78cee4f31096",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "3f27ee49-420e-4659-af1e-849dbac96cce",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "650753f1-fec2-440e-978c-4eb472eb3c25",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "9bd7b8ed-0c92-41a5-9f01-ffa37b319a5e",
            "latches": [
                "217469df-b945-48ef-b5b8-7e690aec5712"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "ec2bd4ce-7482-4b9d-a849-251ba616da0e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "ed189895-7259-4fc5-8c6c-141f4c73b28f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "65260ef3-ae80-4120-b569-56c92abe7fb9",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6f5e7a28-82cf-479a-bc32-f2d9c5fa56c2",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "8cf690a3-4524-4e4e-9dfd-f30f997d9cfd",
            "latches": []
        },
        {
            "id": "file",
            "instance": "d1ac682d-4af2-4f22-9816-35516654dccb",
            "properties": [
                [
                    "name",
                    "\\PROGRA~1\\COMMON~1\\MICROS~1\\WEBSER~1\\15\\TEMPLATE\\LAYOUTS\\spinstall0.aspx"
                ],
                [
                    "name_enc",
                    null
                ],
                [
                    "size",
                    null
                ],
                [
                    "hashes",
                    []
                ],
                [
                    "magic_number_hex",
                    null
                ],
                [
                    "mime_type",
                    null
                ],
                [
                    "ctime",
                    null
                ],
                [
                    "mtime",
                    null
                ],
                [
                    "atime",
                    null
                ]
            ],
            "anchors": {
                "0": "3afa23f7-ae89-4715-a245-d33d2139d478",
                "30": "2181f43b-c26b-4381-a8dc-0d9164f87b3c",
                "60": "40042bb8-2e64-4ca7-9ce7-cea9fb16d5bb",
                "90": "fd9cb633-7953-4168-b628-4113f46e1704",
                "120": "124b5da1-a7d3-4c14-9c63-e6984c348916",
                "150": "4baabcad-44b3-4c7d-b2c1-dfbfb5df975d",
                "180": "4a3f9dee-f88d-4f07-8c82-42702dc8c6e8",
                "210": "7a273668-dbc6-475d-a5ec-4dfc5df210f0",
                "240": "4b8482cf-b52a-49e9-a7ff-6884a78317e8",
                "270": "eb26db02-b9c8-4e7c-82d5-5d441ab973ae",
                "300": "89a1e6ca-6832-444a-a0d6-47172e8d509c",
                "330": "8f3731bb-8deb-486a-8140-dc96152ee7cc"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "3afa23f7-ae89-4715-a245-d33d2139d478",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "2181f43b-c26b-4381-a8dc-0d9164f87b3c",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "40042bb8-2e64-4ca7-9ce7-cea9fb16d5bb",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "fd9cb633-7953-4168-b628-4113f46e1704",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "124b5da1-a7d3-4c14-9c63-e6984c348916",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "4baabcad-44b3-4c7d-b2c1-dfbfb5df975d",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "4a3f9dee-f88d-4f07-8c82-42702dc8c6e8",
            "latches": [
                "2ea49c33-51b1-4d66-abec-b6bf4e6aaf5c"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "7a273668-dbc6-475d-a5ec-4dfc5df210f0",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "4b8482cf-b52a-49e9-a7ff-6884a78317e8",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "eb26db02-b9c8-4e7c-82d5-5d441ab973ae",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "89a1e6ca-6832-444a-a0d6-47172e8d509c",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "8f3731bb-8deb-486a-8140-dc96152ee7cc",
            "latches": []
        },
        {
            "id": "action",
            "instance": "88ec52f4-e6a8-4566-a5ea-2148e438e4cf",
            "properties": [
                [
                    "name",
                    "Unsecured Credentials"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0006"
                        ],
                        [
                            "technique",
                            "T1552"
                        ]
                    ]
                ],
                [
                    "description",
                    "The web shell extracts the MachineKey from memory."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "c1fb9ff4-087b-4e4c-aa8d-d960aac9f02a",
                "30": "b788989d-fd3c-478e-b0fb-d1c571b578ec",
                "60": "ee2cc90e-c708-470f-90c3-6e843859c7a2",
                "90": "3bdf0728-3272-48cd-89ab-a74f1b7767c4",
                "120": "aa995daa-1ec1-4cda-8c78-9f7f0ae72bd5",
                "150": "adddba77-2a80-4323-8982-f568ef12f607",
                "180": "a289f074-7ef7-44a2-8293-b53222dfdee4",
                "210": "85254b2c-fb03-4c07-b071-a1f4a9763c1b",
                "240": "1631d4c9-5032-497c-a9a1-80c1aa705201",
                "270": "08e45b53-fd24-483c-9e5c-5fcb4bb6a9b0",
                "300": "85fe69b9-4e49-4149-88fd-7cacb30e0a39",
                "330": "1bc134da-e010-4d00-be1d-3d3453fa1746"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "c1fb9ff4-087b-4e4c-aa8d-d960aac9f02a",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "b788989d-fd3c-478e-b0fb-d1c571b578ec",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "ee2cc90e-c708-470f-90c3-6e843859c7a2",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "3bdf0728-3272-48cd-89ab-a74f1b7767c4",
            "latches": [
                "1f71eceb-c086-44d8-9362-3c5764fd17f1"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "aa995daa-1ec1-4cda-8c78-9f7f0ae72bd5",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "adddba77-2a80-4323-8982-f568ef12f607",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "a289f074-7ef7-44a2-8293-b53222dfdee4",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "85254b2c-fb03-4c07-b071-a1f4a9763c1b",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "1631d4c9-5032-497c-a9a1-80c1aa705201",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "08e45b53-fd24-483c-9e5c-5fcb4bb6a9b0",
            "latches": [
                "1f5424ea-1bd7-42a2-a870-4a21c2a20bef"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "85fe69b9-4e49-4149-88fd-7cacb30e0a39",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1bc134da-e010-4d00-be1d-3d3453fa1746",
            "latches": []
        },
        {
            "id": "action",
            "instance": "f3966e0f-075c-4ce1-a341-dae0e7981c2b",
            "properties": [
                [
                    "name",
                    "Reflective Code Loading"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0005"
                        ],
                        [
                            "technique",
                            "T1620"
                        ]
                    ]
                ],
                [
                    "description",
                    "The web shell uses reflection to access the web configuration from memory."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "02879a35-f2e1-4ef4-96ff-6161e708b361",
                "30": "1029116f-41e7-4fc5-912a-2903a1cd48b6",
                "60": "d9ce86d1-ef73-44cb-9c79-6a59b59fb8d0",
                "90": "dedf479f-d34d-4763-a714-be40bc9c1982",
                "120": "4e848070-78ab-4177-a64a-1f6cd5da87fa",
                "150": "be98f43f-8437-4967-87a6-bb2a0045b9b5",
                "180": "8f3d5419-7dcc-43ea-959e-c1bb0938dd1f",
                "210": "52278cd5-f5fd-49c0-9189-1fa3d60eb41a",
                "240": "8dd928aa-b54a-4d5d-a843-6fb3684be66f",
                "270": "9ff3963c-3fb7-499f-9eca-3828842795ec",
                "300": "0fceffd8-6e0c-4134-a19b-40f84529abd9",
                "330": "bcecc4b1-e33b-4920-b5b8-1a12d1798235"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "02879a35-f2e1-4ef4-96ff-6161e708b361",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1029116f-41e7-4fc5-912a-2903a1cd48b6",
            "latches": [
                "ad08089f-875b-4978-ab4a-6750f875ca96"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "d9ce86d1-ef73-44cb-9c79-6a59b59fb8d0",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "dedf479f-d34d-4763-a714-be40bc9c1982",
            "latches": [
                "2431ed62-7ec9-4f0b-87ce-5f12dd8c0f46"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "4e848070-78ab-4177-a64a-1f6cd5da87fa",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "be98f43f-8437-4967-87a6-bb2a0045b9b5",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "8f3d5419-7dcc-43ea-959e-c1bb0938dd1f",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "52278cd5-f5fd-49c0-9189-1fa3d60eb41a",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "8dd928aa-b54a-4d5d-a843-6fb3684be66f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "9ff3963c-3fb7-499f-9eca-3828842795ec",
            "latches": [
                "f272c315-020f-454c-80a8-8e3a3c799397"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "0fceffd8-6e0c-4134-a19b-40f84529abd9",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "bcecc4b1-e33b-4920-b5b8-1a12d1798235",
            "latches": [
                "7fdc7ff1-8398-439e-bab9-17755c798767"
            ]
        },
        {
            "id": "action",
            "instance": "e75d8848-b1b6-4fa9-80d5-5f50d94c387b",
            "properties": [
                [
                    "name",
                    "Exfiltration Over C2 Channel"
                ],
                [
                    "ttp",
                    [
                        [
                            "tactic",
                            "TA0010"
                        ],
                        [
                            "technique",
                            "T1041"
                        ]
                    ]
                ],
                [
                    "description",
                    "The attacker exfiltrates the MachineKey through the the web shell."
                ],
                [
                    "confidence",
                    null
                ],
                [
                    "execution_start",
                    null
                ],
                [
                    "execution_end",
                    null
                ]
            ],
            "anchors": {
                "0": "ec030168-5dc4-4b22-94ea-8b6155d3175d",
                "30": "320d4d2e-d51f-404c-8981-9f0f0fc3111e",
                "60": "84141100-d5a1-4dc0-a05a-641aec65821a",
                "90": "0ae50c49-9791-4a87-ba44-c916f636e4f8",
                "120": "a0d3e3d4-9f03-4ef9-977b-4e0ea8dfc7b3",
                "150": "b483e13c-3897-473f-b609-88b4d218673a",
                "180": "a6781f8e-dbde-4c56-b5a9-5d4b3783468c",
                "210": "4eaa04cb-da76-478c-8aff-f2918a50cd8f",
                "240": "88a79936-9881-4050-895b-01628c3a2351",
                "270": "de6ac23c-64cd-4e3c-8612-2b4d9c6b38b9",
                "300": "21399d76-8773-4c87-8943-cc26a016741e",
                "330": "1d85e56b-8d0a-48da-861d-796064d985d5"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "ec030168-5dc4-4b22-94ea-8b6155d3175d",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "320d4d2e-d51f-404c-8981-9f0f0fc3111e",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "84141100-d5a1-4dc0-a05a-641aec65821a",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "0ae50c49-9791-4a87-ba44-c916f636e4f8",
            "latches": [
                "bdc7d397-a39b-41ef-aced-4bc5e4e3ac88"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "a0d3e3d4-9f03-4ef9-977b-4e0ea8dfc7b3",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "b483e13c-3897-473f-b609-88b4d218673a",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "a6781f8e-dbde-4c56-b5a9-5d4b3783468c",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "4eaa04cb-da76-478c-8aff-f2918a50cd8f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "88a79936-9881-4050-895b-01628c3a2351",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "de6ac23c-64cd-4e3c-8612-2b4d9c6b38b9",
            "latches": [
                "cf3c95dc-3e78-49f5-89a2-905f1d66e084"
            ]
        },
        {
            "id": "vertical_anchor",
            "instance": "21399d76-8773-4c87-8943-cc26a016741e",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "1d85e56b-8d0a-48da-861d-796064d985d5",
            "latches": []
        },
        {
            "id": "note",
            "instance": "575afe87-6e37-42a6-8327-697623902e25",
            "properties": [
                [
                    "abstract",
                    "Ysoserial"
                ],
                [
                    "content",
                    "For example, ysoserial is an open source tool that forges ViewState cookies given a MachineKey: https://github.com/pwntester/ysoserial.net"
                ],
                [
                    "authors",
                    []
                ]
            ],
            "anchors": {
                "0": "fc375cfc-fe09-4b44-9613-72f4463e796f",
                "30": "fc90d2f9-0688-42f9-936d-6bb4082be48f",
                "60": "4f46ef89-d437-4e7c-a67c-d6265f103550",
                "90": "a4485563-f316-479d-85ef-b4b4e50f7281",
                "120": "1bdf9b80-e7ee-465b-88c9-fcec931701fa",
                "150": "02ec0abc-7a21-4c66-b72e-27d188eb32f6",
                "180": "090d6661-513b-42b6-8d66-457fa6e0223e",
                "210": "73925bf4-54fe-4c6f-acf1-414bac291ddb",
                "240": "d5e97900-238c-4e16-8097-74db5f5ee447",
                "270": "6cc8f87e-fa3f-4605-9b48-081537c841f7",
                "300": "c6907c0a-8a70-4d51-9dd6-10c9ac25402d",
                "330": "3e459cfd-4bd3-4042-a3c0-6584d8421501"
            }
        },
        {
            "id": "horizontal_anchor",
            "instance": "fc375cfc-fe09-4b44-9613-72f4463e796f",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "fc90d2f9-0688-42f9-936d-6bb4082be48f",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "4f46ef89-d437-4e7c-a67c-d6265f103550",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "a4485563-f316-479d-85ef-b4b4e50f7281",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "1bdf9b80-e7ee-465b-88c9-fcec931701fa",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "02ec0abc-7a21-4c66-b72e-27d188eb32f6",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "090d6661-513b-42b6-8d66-457fa6e0223e",
            "latches": [
                "94412c1b-ef54-4577-b50c-a0db26430b5b"
            ]
        },
        {
            "id": "horizontal_anchor",
            "instance": "73925bf4-54fe-4c6f-acf1-414bac291ddb",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "d5e97900-238c-4e16-8097-74db5f5ee447",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "6cc8f87e-fa3f-4605-9b48-081537c841f7",
            "latches": []
        },
        {
            "id": "vertical_anchor",
            "instance": "c6907c0a-8a70-4d51-9dd6-10c9ac25402d",
            "latches": []
        },
        {
            "id": "horizontal_anchor",
            "instance": "3e459cfd-4bd3-4042-a3c0-6584d8421501",
            "latches": []
        }
    ],
    "layout": {
        "a9dd4259-c077-4bec-9166-6c94a4ae8d70": [
            -45,
            -85
        ],
        "fc666848-ebd8-4af4-a926-580fcdffaed2": [
            430,
            -185
        ],
        "3126ebce-3f8d-4685-9985-5106af6cc4d2": [
            -465,
            -85
        ],
        "f162ae8a-a6c9-4eeb-b6e0-7ee6f39f8e2e": [
            -45,
            355
        ],
        "6535fc9f-c489-4ff4-b3ed-a290a25da480": [
            430,
            15
        ],
        "9c343508-dc18-4c18-bb3f-720255216309": [
            425,
            355
        ],
        "d2509fcf-8574-42c5-9b9c-aefc7f70c1cb": [
            -45,
            715
        ],
        "6f4c597c-fa8a-4621-a81d-c697c8e87265": [
            -1160,
            1080
        ],
        "27d8f506-70aa-4732-8011-d8705d75b94a": [
            -1570,
            1080
        ],
        "498fda9e-66c9-48e7-8b3a-32e96c830033": [
            -780,
            960
        ],
        "e5000cc6-e025-44ff-9d81-513ad0cbbf86": [
            -1160,
            1825
        ],
        "569b8f7c-59f2-4df3-9fd9-f8c268130cd9": [
            -1160,
            1475
        ],
        "57890b7f-d16b-49a7-bc5d-fd5b68e2eee0": [
            -735,
            1080
        ],
        "05262d6e-2758-46f6-8061-2e46d7003b6d": [
            -725,
            1205
        ],
        "777dd3e3-48a8-4d7a-9002-aa19fdc07aa7": [
            -735,
            1330
        ],
        "3d049b16-d78d-4fd8-b2a4-91a7d159e827": [
            -685,
            1455
        ],
        "d2dada60-cc73-4b2d-b652-84a9104bcb37": [
            -1160,
            2195
        ],
        "845e5642-6ed8-4403-864e-6234ef03209c": [
            -320,
            1250
        ],
        "008353db-6512-4d03-aeea-0bd065ed0a97": [
            85,
            1250
        ],
        "f3f53445-df65-439e-8d00-6798a6ae52c7": [
            85,
            1650
        ],
        "637a45fa-407f-41c3-994a-536860d4bf3f": [
            505,
            1650
        ],
        "54f36148-bba7-4a97-aaa5-8493be71ef0d": [
            1015,
            1145
        ],
        "0b2518af-d570-43f3-b1c6-90988a96ace8": [
            85,
            2035
        ],
        "9f90fa81-aa0e-4caa-b754-e33d491b56c1": [
            610,
            1145
        ],
        "3e5ecd65-6165-4dfb-9642-2b49ce2e80a1": [
            85,
            2600
        ],
        "5ecca340-5fd5-45f9-acb5-136cbe15dac8": [
            1465,
            1610
        ],
        "d1ac682d-4af2-4f22-9816-35516654dccb": [
            1465,
            1425
        ],
        "88ec52f4-e6a8-4566-a5ea-2148e438e4cf": [
            1015,
            1855
        ],
        "f3966e0f-075c-4ce1-a341-dae0e7981c2b": [
            1015,
            1530
        ],
        "e75d8848-b1b6-4fa9-80d5-5f50d94c387b": [
            1015,
            2185
        ],
        "575afe87-6e37-42a6-8327-697623902e25": [
            565,
            2600
        ],
        "e18f4494-174b-4526-bd7c-c5591a57465b": [
            -850,
            1143
        ],
        "fb664199-767f-4381-b95f-a40455c87102": [
            -885,
            1205
        ],
        "5f28e14f-8129-4773-bb5c-6c5d2dd1a521": [
            -915,
            1303
        ],
        "863553fa-34dd-4bc4-8a8d-c2a77fd9df10": [
            528,
            885
        ]
    },
    "camera": {
        "x": 169,
        "y": 2847,
        "k": 0.9220791504409355
    }
}