{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 1, "deduplicated_iocs": 4, "direct_entities": 11, "direct_relationships": 14, "invalid_iocs": 0, "iocs": 4, "mentioned": 2, "mitre_associated": 13, "mitre_direct": 0, "targets": 0, "techniques": 0, "unsupported_indicators": 1, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 345, "excluded_graph_objects": 160, "graph_complete": true, "graph_objects": 11, "graph_relationships": 14, "mitre_context_complete": true, "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "status_as_of": "2026-10-10T09:26:29+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T11:22:48.146Z", "updated_at": "2026-09-26T11:22:48.315Z" }, "description_available": false, "entity_type": "StixFile", "id": "155e567d-21dc-439f-9942-cbbae3af368e", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "file--5f7d8090-ef2e-59c8-8b07-9fdaea9be64c", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T11:22:48.192Z", "updated_at": "2026-09-26T11:22:48.502Z" }, "description_available": false, "entity_type": "StixFile", "id": "1723c249-12b3-4e88-bafb-1f15f29d8efa", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "file--b8313f6f-361c-5c30-936c-f515d45e2533", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.136Z", "created_at": "2026-09-26T11:22:49.905Z", "modified": "2026-09-26T11:22:52.286Z", "updated_at": "2026-09-26T11:22:52.286Z" }, "description_available": false, "entity_type": "Indicator", "id": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "indicator--77677b83-15a4-5b1b-8804-f2dbb5ed1fdd", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T11:22:47.047Z", "updated_at": "2026-09-26T11:22:47.428Z" }, "description_available": false, "entity_type": "StixFile", "id": "38ffe9f9-bd65-4760-8db4-bafe3de774c3", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "file--ebdcdf15-6251-5e25-af48-2615d3cc81d5", "type": "StixFile" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.093Z", "created_at": "2026-09-26T11:22:45.198Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-09-26T11:22:45.418Z", "updated_at": "2026-09-26T11:22:45.418Z" }, "description_available": false, "entity_type": "Malware", "id": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "is_inferred": false, "labels": [], "lang": "en", "name": "PIVOTPIPE", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "malware--0d261616-1eff-567c-a4ea-eef0c99ff4ef", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.145Z", "created_at": "2026-09-26T11:22:52.019Z", "modified": "2026-09-26T11:22:59.472Z", "updated_at": "2026-09-26T11:22:59.472Z" }, "description_available": false, "entity_type": "Indicator", "id": "4f0e8100-ff0d-47d2-a25c-199f28356419", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "indicator--f8cd4edb-0e2b-5b77-8373-4786e753b1a9", "type": "Indicator" }, { "__typename": "Malware", "aliases": [], "attributes": { "is_family": false }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.087Z", "created_at": "2026-01-19T17:43:57.855Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-01-19T17:43:58.116Z", "updated_at": "2026-01-19T17:43:58.116Z" }, "description_available": false, "entity_type": "Malware", "id": "657ff382-024b-45a4-974a-3e41f1762074", "is_inferred": false, "labels": [], "lang": "en", "name": "Cobalt Strike - S0154", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "malware--6c93bbcc-ce1a-5089-ade3-c596b7d58adb", "type": "Malware" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.141Z", "created_at": "2026-09-26T11:22:50.135Z", "modified": "2026-09-26T11:22:56.765Z", "updated_at": "2026-09-26T11:22:56.765Z" }, "description_available": false, "entity_type": "Indicator", "id": "68842531-f409-49f1-8162-cd3ff2077a42", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "indicator--32964826-68b7-526b-8f92-5a92e2ae719c", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T11:22:47.126Z", "updated_at": "2026-09-26T11:22:47.429Z" }, "description_available": false, "entity_type": "StixFile", "id": "9b13f821-575d-4599-86d6-93e0763fc073", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "file--d9e7982a-fdb4-57f3-9c7f-528399b2e91d", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "yara", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.151Z", "created_at": "2026-09-26T11:22:58.542Z", "modified": "2026-09-26T11:23:02.094Z", "updated_at": "2026-09-26T11:23:02.094Z" }, "description_available": true, "entity_type": "Indicator", "id": "bf3d31a8-9f0a-44fe-b02b-6d285d20a9b9", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "indicator--c8021be7-51ee-59b3-a86f-ae89b04327ee", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.149Z", "created_at": "2026-09-26T11:22:52.005Z", "modified": "2026-09-26T11:22:58.646Z", "updated_at": "2026-09-26T11:22:58.646Z" }, "description_available": false, "entity_type": "Indicator", "id": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "indicator--18ac7e7d-5246-5465-89c9-5f84f04f8933", "type": "Indicator" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.191Z", "created_at": "2026-09-26T11:24:35.527Z", "modified": "2026-09-26T11:24:35.982Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:24:35.982Z" }, "description_available": false, "entity_type": "indicates", "fromId": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "from_id": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "from_name": null, "from_type": "Indicator", "id": "4a6f39e2-bb21-417f-b0d0-4effbaea2bac", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--8ea87eb0-d7d8-5d28-96ae-0f632dc4e487", "toId": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_id": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_name": "PIVOTPIPE", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.144Z", "created_at": "2026-09-26T11:23:37.263Z", "modified": "2026-09-26T11:23:40.756Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:23:40.756Z" }, "description_available": false, "entity_type": "based-on", "fromId": "68842531-f409-49f1-8162-cd3ff2077a42", "from_id": "68842531-f409-49f1-8162-cd3ff2077a42", "from_name": null, "from_type": "Indicator", "id": "4b2a2e09-e67a-4652-bbe5-431103822e3d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--2e944eb6-b54b-5c73-b0a5-507c902ab0c1", "toId": "38ffe9f9-bd65-4760-8db4-bafe3de774c3", "to_id": "38ffe9f9-bd65-4760-8db4-bafe3de774c3", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.147Z", "created_at": "2026-09-26T11:23:37.756Z", "modified": "2026-09-26T11:23:40.755Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:23:40.755Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4f0e8100-ff0d-47d2-a25c-199f28356419", "from_id": "4f0e8100-ff0d-47d2-a25c-199f28356419", "from_name": null, "from_type": "Indicator", "id": "5fb0be20-71d6-45da-ac50-41596cf8a16d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--d206e8e2-2684-5087-8a1f-9109617ddd47", "toId": "155e567d-21dc-439f-9942-cbbae3af368e", "to_id": "155e567d-21dc-439f-9942-cbbae3af368e", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.180Z", "created_at": "2026-09-26T11:24:19.203Z", "modified": "2026-09-26T11:24:19.526Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:24:19.526Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4f0e8100-ff0d-47d2-a25c-199f28356419", "from_id": "4f0e8100-ff0d-47d2-a25c-199f28356419", "from_name": null, "from_type": "Indicator", "id": "65e3b37f-0424-4c68-ac2f-b0008e430961", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--333474dc-3835-536e-8667-8dcb920784ec", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.205Z", "created_at": "2026-09-26T11:24:53.890Z", "modified": "2026-09-26T11:24:54.185Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:24:54.185Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bf3d31a8-9f0a-44fe-b02b-6d285d20a9b9", "from_id": "bf3d31a8-9f0a-44fe-b02b-6d285d20a9b9", "from_name": null, "from_type": "Indicator", "id": "6f39c99f-d0ad-4593-94be-9b6681721ea7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--aa7da79c-d6a3-5d66-bfa6-f228f20a617a", "toId": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_id": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_name": "PIVOTPIPE", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.167Z", "created_at": "2026-09-26T11:24:00.179Z", "modified": "2026-09-26T11:24:00.515Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:24:00.515Z" }, "description_available": false, "entity_type": "indicates", "fromId": "68842531-f409-49f1-8162-cd3ff2077a42", "from_id": "68842531-f409-49f1-8162-cd3ff2077a42", "from_name": null, "from_type": "Indicator", "id": "6fa5cdf1-4a23-42b8-ab9a-e39b38e4f157", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--efdc8393-3754-56a1-a070-7888e9bc4893", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.206Z", "created_at": "2026-09-26T11:24:54.625Z", "modified": "2026-09-26T11:24:54.827Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:24:54.827Z" }, "description_available": false, "entity_type": "indicates", "fromId": "bf3d31a8-9f0a-44fe-b02b-6d285d20a9b9", "from_id": "bf3d31a8-9f0a-44fe-b02b-6d285d20a9b9", "from_name": null, "from_type": "Indicator", "id": "728ba644-579d-4062-bd96-953a08c00902", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--e405fa8c-c405-5511-866f-ab3aa8faefcb", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.139Z", "created_at": "2026-09-26T11:23:37.170Z", "modified": "2026-09-26T11:23:38.635Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:23:38.635Z" }, "description_available": false, "entity_type": "based-on", "fromId": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "from_id": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "from_name": null, "from_type": "Indicator", "id": "994159f4-f691-41e2-8153-bfc7b46072fa", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--43645daf-4f90-580c-8991-1d7862e349b2", "toId": "9b13f821-575d-4599-86d6-93e0763fc073", "to_id": "9b13f821-575d-4599-86d6-93e0763fc073", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.152Z", "created_at": "2026-09-26T11:23:42.428Z", "modified": "2026-09-26T11:23:42.714Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:23:42.714Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "from_id": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "from_name": null, "from_type": "Indicator", "id": "ad5fbd3d-95a1-4f19-bef7-38fae0f75129", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--1bcaf9bd-7a05-5368-940b-872624a906e0", "toId": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_id": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_name": "PIVOTPIPE", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.179Z", "created_at": "2026-09-26T11:24:17.496Z", "modified": "2026-09-26T11:24:18.791Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:24:18.791Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4f0e8100-ff0d-47d2-a25c-199f28356419", "from_id": "4f0e8100-ff0d-47d2-a25c-199f28356419", "from_name": null, "from_type": "Indicator", "id": "b0a001cb-ba5b-443a-a6d7-b1914504c05c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--a50bcbf7-a734-533a-aa4d-f8ea2b40ee40", "toId": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_id": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_name": "PIVOTPIPE", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.151Z", "created_at": "2026-09-26T11:23:41.188Z", "modified": "2026-09-26T11:23:41.716Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:23:41.716Z" }, "description_available": false, "entity_type": "based-on", "fromId": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "from_id": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "from_name": null, "from_type": "Indicator", "id": "da2dd545-9c54-4a2c-8af4-7875bdd2f6d1", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--d415e8ab-9778-57a5-bf6e-ae0d0f3e6cad", "toId": "1723c249-12b3-4e88-bafb-1f15f29d8efa", "to_id": "1723c249-12b3-4e88-bafb-1f15f29d8efa", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.167Z", "created_at": "2026-09-26T11:23:59.594Z", "modified": "2026-09-26T11:23:59.829Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:23:59.829Z" }, "description_available": false, "entity_type": "indicates", "fromId": "68842531-f409-49f1-8162-cd3ff2077a42", "from_id": "68842531-f409-49f1-8162-cd3ff2077a42", "from_name": null, "from_type": "Indicator", "id": "de180f6f-e0ee-469e-bd8e-9efb7f8ad900", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--20181b43-f462-5f3a-a008-92124b88e6ab", "toId": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_id": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "to_name": "PIVOTPIPE", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.153Z", "created_at": "2026-09-26T11:23:41.578Z", "modified": "2026-09-26T11:23:42.030Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:23:42.030Z" }, "description_available": false, "entity_type": "indicates", "fromId": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "from_id": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "from_name": null, "from_type": "Indicator", "id": "eab3331f-64bb-459a-b5a1-4bf4b9ac1688", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--07540a6c-770f-5123-8e31-139c692b2f57", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:43.192Z", "created_at": "2026-09-26T11:24:36.644Z", "modified": "2026-09-26T11:24:36.988Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T11:24:36.988Z" }, "description_available": false, "entity_type": "indicates", "fromId": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "from_id": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "from_name": null, "from_type": "Indicator", "id": "ef3a9950-cf21-4211-a7b3-b7617fbb85bb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--f2f5ae97-661f-5411-8272-6231117e1535", "toId": "657ff382-024b-45a4-974a-3e41f1762074", "to_id": "657ff382-024b-45a4-974a-3e41f1762074", "to_name": "Cobalt Strike - S0154", "to_type": "Malware" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "9c20927c77efe4119dc46fabf1a6cffebf0acc63", "description_available": false, "object_id": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "object_ids": [ "1723c249-12b3-4e88-bafb-1f15f29d8efa", "db23e6e5-dcc7-405a-9d51-0de9d994cf95" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "db23e6e5-dcc7-405a-9d51-0de9d994cf95", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "9c20927c77efe4119dc46fabf1a6cffebf0acc63" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "1723c249-12b3-4e88-bafb-1f15f29d8efa", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "9c20927c77efe4119dc46fabf1a6cffebf0acc63" } ], "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "type": "sha1", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "9c20927c77efe4119dc46fabf1a6cffebf0acc63" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "715558e0ad32401c477d01412cc72fd07dc4ef6e122b6a730ba4b0a88a971677", "description_available": false, "object_id": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "object_ids": [ "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "9b13f821-575d-4599-86d6-93e0763fc073" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "2a34b1ef-7771-4afe-9c3b-5d7d84ac719f", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "715558e0ad32401c477d01412cc72fd07dc4ef6e122b6a730ba4b0a88a971677" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "9b13f821-575d-4599-86d6-93e0763fc073", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "715558e0ad32401c477d01412cc72fd07dc4ef6e122b6a730ba4b0a88a971677" } ], "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "type": "sha256", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "715558e0ad32401c477d01412cc72fd07dc4ef6e122b6a730ba4b0a88a971677" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ad9a03f3ea93c1a0a350f73b4ada485ce444f2352ea11eea05c87f075be80cf7", "description_available": false, "object_id": "68842531-f409-49f1-8162-cd3ff2077a42", "object_ids": [ "38ffe9f9-bd65-4760-8db4-bafe3de774c3", "68842531-f409-49f1-8162-cd3ff2077a42" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "68842531-f409-49f1-8162-cd3ff2077a42", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "ad9a03f3ea93c1a0a350f73b4ada485ce444f2352ea11eea05c87f075be80cf7" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "38ffe9f9-bd65-4760-8db4-bafe3de774c3", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ad9a03f3ea93c1a0a350f73b4ada485ce444f2352ea11eea05c87f075be80cf7" } ], "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "type": "sha256", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "ad9a03f3ea93c1a0a350f73b4ada485ce444f2352ea11eea05c87f075be80cf7" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "feeb5cae714d0d35f68ad1d1b29dccec0bdcc58ac076869559db53f6cb8137e8", "description_available": false, "object_id": "4f0e8100-ff0d-47d2-a25c-199f28356419", "object_ids": [ "155e567d-21dc-439f-9942-cbbae3af368e", "4f0e8100-ff0d-47d2-a25c-199f28356419" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4f0e8100-ff0d-47d2-a25c-199f28356419", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "feeb5cae714d0d35f68ad1d1b29dccec0bdcc58ac076869559db53f6cb8137e8" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "155e567d-21dc-439f-9942-cbbae3af368e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "feeb5cae714d0d35f68ad1d1b29dccec0bdcc58ac076869559db53f6cb8137e8" } ], "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "type": "sha256", "valid_from": "2026-09-16T07:16:36.000Z", "valid_until": "2027-07-03T18:26:20.557Z", "validity_status": "active", "value": "feeb5cae714d0d35f68ad1d1b29dccec0bdcc58ac076869559db53f6cb8137e8" } ], "mentioned": [ { "confidence": 50, "evidence_id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "role": "mentionné", "type": "Malware" }, { "confidence": 50, "evidence_id": "46a15456-31c8-442d-9ad4-0b28bb5b148b", "name": "PIVOTPIPE", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.115Z", "created_at": "2026-01-19T17:45:38.090Z", "modified": "2026-01-19T17:45:38.961Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T17:45:38.961Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "017556d5-24b2-4dc2-8752-c31cadda6456", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--4ea4e126-d22d-5cb2-bc0a-28a62f245b7c", "toId": "6dc3b6a2-d526-4427-a8df-edeef4fc095e", "to_id": "6dc3b6a2-d526-4427-a8df-edeef4fc095e", "to_name": "T1023", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.183Z", "created_at": "2026-03-16T15:07:48.420Z", "modified": "2026-03-16T15:07:49.094Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:49.094Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "0e77135a-13e2-48f4-bf6c-8a2567d47409", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--0b905d88-e0e7-58b2-baee-2a8f78f0f3f3", "toId": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "to_name": "TA0001", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:10:21.536Z", "created_at": "2026-01-19T18:50:20.700Z", "modified": "2026-01-19T18:50:21.107Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T18:50:21.107Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "1abc6712-067a-4c79-9bc6-52cadb947b78", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--136c04da-77e3-55bc-99e7-bf9f0ac6404c", "toId": "49e99359-b1d6-4e62-b704-5336d333ed05", "to_id": "49e99359-b1d6-4e62-b704-5336d333ed05", "to_name": "T1086", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.180Z", "created_at": "2026-03-16T15:07:41.871Z", "modified": "2026-03-16T15:07:42.423Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:42.423Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "3807de46-2db8-4f96-a5a9-7754776911c8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--9e5504a3-e16e-51fe-83d5-cfdbb17e736a", "toId": "50941343-5131-46d0-acab-3576025e11f7", "to_id": "50941343-5131-46d0-acab-3576025e11f7", "to_name": "TA0005", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T17:45:26.577Z", "created_at": "2026-02-20T20:13:44.828Z", "modified": "2026-02-20T20:13:45.743Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-20T20:13:45.743Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "62f6950e-034b-4a45-90cc-a7c2171423c2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--c115719f-d328-5689-9d9b-54f4b2b652ef", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.113Z", "created_at": "2026-01-19T17:45:32.166Z", "modified": "2026-01-19T17:45:32.713Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T17:45:32.713Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "7ff60055-21c1-409a-9560-13b0dcf950ce", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--8fc0957c-f400-58fb-855d-59a6e760cb04", "toId": "8cbc136d-7185-4164-a1a0-8a5e3934d4ad", "to_id": "8cbc136d-7185-4164-a1a0-8a5e3934d4ad", "to_name": "T1060", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.181Z", "created_at": "2026-03-16T15:07:42.916Z", "modified": "2026-03-16T15:07:43.200Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:43.200Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "974f2eb7-8de9-4a1c-b2ec-240a523c6f54", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--1a20b9c7-12bb-57d8-92d6-e0dadeebdcc2", "toId": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "to_name": "TA0007", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.179Z", "created_at": "2026-03-16T15:07:44.457Z", "modified": "2026-03-16T15:07:46.436Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:46.436Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "9a97c37b-581e-435d-9ee4-9e13de661c3c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--0cecf0c5-df70-559f-9807-728ae3a71299", "toId": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "to_name": "TA0008", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:30:54.400Z", "created_at": "2026-03-11T02:42:40.730Z", "modified": "2026-03-11T02:43:19.495Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-11T02:43:19.495Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "afc68bd6-780a-446b-ac07-01c998c20543", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--ac2ff5b0-254a-51e8-bebc-1feb53046ec9", "toId": "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "to_id": "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "to_name": "T1076", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:28:13.311Z", "created_at": "2026-02-07T18:57:07.478Z", "modified": "2026-02-07T18:57:07.687Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-07T18:57:07.687Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "c9ce065e-9319-40f8-9b44-01abc213f470", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--6f4fc28e-1650-5290-9fa1-18da1af1f484", "toId": "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "to_id": "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "to_name": "T1081", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-18T18:09:56.116Z", "created_at": "2026-01-19T17:45:40.121Z", "modified": "2026-01-19T17:45:41.066Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-01-19T17:45:41.066Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "ccad1c23-1d29-4c03-b68d-bb609200c46f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--e91673d6-f1d7-5893-936f-0f20cc00f3a7", "toId": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_id": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_name": "T1094", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T20:01:36.181Z", "created_at": "2026-03-16T15:07:50.560Z", "modified": "2026-03-16T15:07:52.428Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-16T15:07:52.428Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "d1ef7489-e412-4254-bc01-53379622042e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--f349d62e-4e7e-50b9-9f72-9704cc803854", "toId": "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "to_id": "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "to_name": "TA0010", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T16:20:54.931Z", "created_at": "2026-02-06T14:17:05.293Z", "modified": "2026-02-06T14:17:09.475Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-02-06T14:17:09.475Z" }, "description_available": false, "entity_type": "uses", "fromId": "657ff382-024b-45a4-974a-3e41f1762074", "from_id": "657ff382-024b-45a4-974a-3e41f1762074", "from_name": "Cobalt Strike - S0154", "from_type": "Malware", "id": "f06d17b2-6c54-4eb2-a5fe-4bd0950c822b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "standard_id": "relationship--ed2ad588-1d3e-5058-89b6-ebabd50a37f2", "toId": "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "to_id": "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "to_name": "T1045", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "TA0008" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.150Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.150Z", "created_at": "2026-01-21T11:31:19.514Z", "modified": "2026-01-21T11:31:20.180Z", "updated_at": "2026-01-21T11:31:20.180Z" }, "description_available": false, "evidence_ids": [ "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "9a97c37b-581e-435d-9ee4-9e13de661c3c" ], "external_id": null, "id": "007d40c1-8ed8-41d8-9959-0e44fd2b4e84", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-01-21T11:31:20.180Z", "name": "TA0008", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0008", "id": "ad7866d4-e709-45c7-a0b3-721cd0ac76a9", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0008" } ], "relationship_ids": [ "9a97c37b-581e-435d-9ee4-9e13de661c3c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0001" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:16:18.950Z", "created_by": null, "dates": { "created": "2026-01-19T18:16:18.950Z", "created_at": "2026-02-26T09:42:18.208Z", "modified": "2026-02-26T09:42:18.968Z", "updated_at": "2026-02-26T09:42:18.968Z" }, "description_available": false, "evidence_ids": [ "008dd51f-8f8d-4be2-a41b-6191033560d2", "0e77135a-13e2-48f4-bf6c-8a2567d47409" ], "external_id": null, "id": "008dd51f-8f8d-4be2-a41b-6191033560d2", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-26T09:42:18.968Z", "name": "TA0001", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0001", "id": "b9b34b9a-84bd-442c-a126-8dd241c3fecc", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0001" } ], "relationship_ids": [ "0e77135a-13e2-48f4-bf6c-8a2567d47409" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1045" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:02:52.598Z", "created_by": null, "dates": { "created": "2026-01-18T18:02:52.598Z", "created_at": "2026-01-18T18:17:47.648Z", "modified": "2026-01-18T18:17:48.365Z", "updated_at": "2026-01-18T18:17:48.365Z" }, "description_available": false, "evidence_ids": [ "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "f06d17b2-6c54-4eb2-a5fe-4bd0950c822b" ], "external_id": "T1045", "id": "0274a80d-ba1a-4dd7-95cd-cb9aad2b548a", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1045", "modified": "2026-01-18T18:17:48.365Z", "name": "T1045", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1045", "id": "779e0644-aa4d-451c-9079-29ebc2cf5705", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1045" } ], "relationship_ids": [ "f06d17b2-6c54-4eb2-a5fe-4bd0950c822b" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1045/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1094" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.695Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.695Z", "created_at": "2026-01-18T22:32:58.220Z", "modified": "2026-01-18T22:33:01.087Z", "updated_at": "2026-01-18T22:33:01.087Z" }, "description_available": false, "evidence_ids": [ "0c43fa3c-1023-4011-bc40-c398438711c9", "ccad1c23-1d29-4c03-b68d-bb609200c46f" ], "external_id": "T1094", "id": "0c43fa3c-1023-4011-bc40-c398438711c9", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1094", "modified": "2026-01-18T22:33:01.087Z", "name": "T1094", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1094", "id": "fb43a6ff-5bf1-40b3-8e1c-ce8220f7163b", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1094" } ], "relationship_ids": [ "ccad1c23-1d29-4c03-b68d-bb609200c46f" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1094/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0010" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:52:03.139Z", "created_by": null, "dates": { "created": "2026-01-18T18:52:03.139Z", "created_at": "2026-01-24T03:42:30.097Z", "modified": "2026-01-24T03:42:30.732Z", "updated_at": "2026-01-24T03:42:30.732Z" }, "description_available": false, "evidence_ids": [ "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "d1ef7489-e412-4254-bc01-53379622042e" ], "external_id": null, "id": "3c4ed719-1a23-4538-bce0-ec21c8e5e5ae", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-01-24T03:42:30.732Z", "name": "TA0010", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0010", "id": "e17eefd7-f8f6-4eda-913c-2508d56b7270", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0010" } ], "relationship_ids": [ "d1ef7489-e412-4254-bc01-53379622042e" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1086" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:06:32.388Z", "created_by": null, "dates": { "created": "2026-01-18T18:06:32.388Z", "created_at": "2026-01-19T07:30:45.408Z", "modified": "2026-01-19T07:30:46.032Z", "updated_at": "2026-01-19T07:30:46.032Z" }, "description_available": false, "evidence_ids": [ "1abc6712-067a-4c79-9bc6-52cadb947b78", "49e99359-b1d6-4e62-b704-5336d333ed05" ], "external_id": "T1086", "id": "49e99359-b1d6-4e62-b704-5336d333ed05", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1086", "modified": "2026-01-19T07:30:46.032Z", "name": "T1086", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1086", "id": "9aee59f9-5700-4980-a072-87df39de0dfd", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1086" } ], "relationship_ids": [ "1abc6712-067a-4c79-9bc6-52cadb947b78" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1086/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0005" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T16:41:04.446Z", "created_by": null, "dates": { "created": "2026-01-19T16:41:04.446Z", "created_at": "2026-02-10T07:30:32.216Z", "modified": "2026-02-10T07:30:32.428Z", "updated_at": "2026-02-10T07:30:32.428Z" }, "description_available": false, "evidence_ids": [ "3807de46-2db8-4f96-a5a9-7754776911c8", "50941343-5131-46d0-acab-3576025e11f7" ], "external_id": null, "id": "50941343-5131-46d0-acab-3576025e11f7", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-10T07:30:32.428Z", "name": "TA0005", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0005", "id": "a9112572-039f-413c-83b9-8baf4225ca60", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0005" } ], "relationship_ids": [ "3807de46-2db8-4f96-a5a9-7754776911c8" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1023" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:05:20.838Z", "created_by": null, "dates": { "created": "2026-01-18T18:05:20.838Z", "created_at": "2026-01-19T04:00:19.227Z", "modified": "2026-01-19T04:00:19.824Z", "updated_at": "2026-01-19T04:00:19.824Z" }, "description_available": false, "evidence_ids": [ "017556d5-24b2-4dc2-8752-c31cadda6456", "6dc3b6a2-d526-4427-a8df-edeef4fc095e" ], "external_id": "T1023", "id": "6dc3b6a2-d526-4427-a8df-edeef4fc095e", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1023", "modified": "2026-01-19T04:00:19.824Z", "name": "T1023", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1023", "id": "05232979-69bd-4f87-9874-3fe49f8ba171", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1023" } ], "relationship_ids": [ "017556d5-24b2-4dc2-8752-c31cadda6456" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1023/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1081" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:31:36.615Z", "created_by": null, "dates": { "created": "2026-01-18T18:31:36.615Z", "created_at": "2026-01-21T20:49:48.192Z", "modified": "2026-01-21T20:49:48.560Z", "updated_at": "2026-01-21T20:49:48.560Z" }, "description_available": false, "evidence_ids": [ "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "c9ce065e-9319-40f8-9b44-01abc213f470" ], "external_id": "T1081", "id": "7ea7cb32-9909-4ee9-9a11-41a64fbb0d98", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1081", "modified": "2026-01-21T20:49:48.560Z", "name": "T1081", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1081", "id": "a7b8c2bf-d09e-432b-a8e6-952e1d0aa432", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1081" } ], "relationship_ids": [ "c9ce065e-9319-40f8-9b44-01abc213f470" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1081/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1076" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:10:33.837Z", "created_by": null, "dates": { "created": "2026-01-18T18:10:33.837Z", "created_at": "2026-01-19T19:18:03.982Z", "modified": "2026-01-19T19:18:05.388Z", "updated_at": "2026-01-19T19:18:05.388Z" }, "description_available": false, "evidence_ids": [ "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "afc68bd6-780a-446b-ac07-01c998c20543" ], "external_id": "T1076", "id": "87c0091a-bb57-4ddd-8be3-849dd3ee13bb", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1076", "modified": "2026-01-19T19:18:05.388Z", "name": "T1076", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1076", "id": "61ff2bcd-7406-40c2-8261-ef53f8248d9f", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1076" } ], "relationship_ids": [ "afc68bd6-780a-446b-ac07-01c998c20543" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1076/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1060" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:02:56.955Z", "created_by": null, "dates": { "created": "2026-01-18T18:02:56.955Z", "created_at": "2026-01-18T18:20:19.945Z", "modified": "2026-01-18T18:20:20.258Z", "updated_at": "2026-01-18T18:20:20.258Z" }, "description_available": false, "evidence_ids": [ "7ff60055-21c1-409a-9560-13b0dcf950ce", "8cbc136d-7185-4164-a1a0-8a5e3934d4ad" ], "external_id": "T1060", "id": "8cbc136d-7185-4164-a1a0-8a5e3934d4ad", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1060", "modified": "2026-01-18T18:20:20.258Z", "name": "T1060", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1060", "id": "e3370d72-be82-43ba-a214-9485a9e8708c", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1060" } ], "relationship_ids": [ "7ff60055-21c1-409a-9560-13b0dcf950ce" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1060/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "TA0007" }, "authorized_members": [], "confidence": 50, "created": "2026-01-19T18:04:26.693Z", "created_by": null, "dates": { "created": "2026-01-19T18:04:26.693Z", "created_at": "2026-02-24T10:59:25.122Z", "modified": "2026-02-24T10:59:25.604Z", "updated_at": "2026-02-24T10:59:25.604Z" }, "description_available": false, "evidence_ids": [ "974f2eb7-8de9-4a1c-b2ec-240a523c6f54", "b567183b-d314-4266-96a5-7c9ed53ab2b0" ], "external_id": null, "id": "b567183b-d314-4266-96a5-7c9ed53ab2b0", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": null, "modified": "2026-02-24T10:59:25.604Z", "name": "TA0007", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "TA0007", "id": "9e1f03d3-a465-4763-b502-2eb00bbd87eb", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/TA0007" } ], "relationship_ids": [ "974f2eb7-8de9-4a1c-b2ec-240a523c6f54" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": null, "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "62f6950e-034b-4a45-90cc-a7c2171423c2", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "62f6950e-034b-4a45-90cc-a7c2171423c2" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } ] } ], "via_entity": { "id": "657ff382-024b-45a4-974a-3e41f1762074", "name": "Cobalt Strike - S0154", "type": "Malware" } } ], "direct_techniques": [], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T09:26:35Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1023/", "created": "2017-05-31T21:30:30.757Z", "deprecated": false, "matched": true, "mitre_id": "T1023", "modified": "2025-10-24T17:49:07.761Z", "official_name": "Shortcut Modification", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1547/009/", "mitre_id": "T1547.009", "official_name": "Shortcut Modification", "official_status": "active", "relationship_id": "relationship--fe8358f5-ead6-4ae7-a88c-831dda8ab123", "stix_id": "attack-pattern--4ab929c6-ee2d-4fb5-aab4-b14be2ed7179" } ], "revoked": true, "stix_id": "attack-pattern--970cdb5c-02fb-4c38-b17e-d6327cf3c810" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1045/", "created": "2017-05-31T21:30:43.472Z", "deprecated": false, "matched": true, "mitre_id": "T1045", "modified": "2026-04-14T22:53:14.880Z", "official_name": "Software Packing", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1027/002/", "mitre_id": "T1027.002", "official_name": "Software Packing", "official_status": "active", "relationship_id": "relationship--3d131e85-111d-4df2-ba93-274acba5146f", "stix_id": "attack-pattern--deb98323-e13f-4b0c-8d94-175379069062" } ], "revoked": true, "stix_id": "attack-pattern--6ff403bc-93e3-48be-8687-e102fdba8c88" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1060/", "created": "2017-05-31T21:30:49.988Z", "deprecated": false, "matched": true, "mitre_id": "T1060", "modified": "2025-10-24T17:49:07.015Z", "official_name": "Registry Run Keys / Startup Folder", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1547/001/", "mitre_id": "T1547.001", "official_name": "Registry Run Keys / Startup Folder", "official_status": "active", "relationship_id": "relationship--330c49c0-a785-46f9-99c1-74322e26e20d", "stix_id": "attack-pattern--9efb1ea7-c37b-4595-9640-b7680cd84279" } ], "revoked": true, "stix_id": "attack-pattern--9422fc14-1c43-410d-ab0f-a709b76c72dc" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1076/", "created": "2017-05-31T21:30:59.769Z", "deprecated": false, "matched": true, "mitre_id": "T1076", "modified": "2025-10-24T17:48:46.864Z", "official_name": "Remote Desktop Protocol", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0008", "name": "Lateral Movement", "shortname": "lateral-movement" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1021/001/", "mitre_id": "T1021.001", "official_name": "Remote Desktop Protocol", "official_status": "active", "relationship_id": "relationship--fd31c763-8e36-4f6f-9238-fed081b524b3", "stix_id": "attack-pattern--eb062747-2193-45de-8fa2-e62549c37ddf" } ], "revoked": true, "stix_id": "attack-pattern--51dea151-0898-4a45-967c-3ebee0420484" }, { "attack_version": "1.3", "canonical_url": "https://attack.mitre.org/techniques/T1081/", "created": "2017-05-31T21:31:02.188Z", "deprecated": false, "matched": true, "mitre_id": "T1081", "modified": "2025-10-24T17:49:17.543Z", "official_name": "Credentials in Files", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0006", "name": "Credential Access", "shortname": "credential-access" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1552/001/", "mitre_id": "T1552.001", "official_name": "Credentials In Files", "official_status": "active", "relationship_id": "relationship--25ca7826-9f46-45e4-97e8-c942f9a2611d", "stix_id": "attack-pattern--837f9164-50af-4ac0-8219-379d8a74cefc" } ], "revoked": true, "stix_id": "attack-pattern--ba8e391f-14b5-496f-81f2-2d5ecd646c1c" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1086/", "created": "2017-05-31T21:31:06.512Z", "deprecated": false, "matched": true, "mitre_id": "T1086", "modified": "2025-10-24T17:49:36.765Z", "official_name": "PowerShell", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1059/001/", "mitre_id": "T1059.001", "official_name": "PowerShell", "official_status": "active", "relationship_id": "relationship--d948a3b2-4873-4175-be18-ddef1c20347d", "stix_id": "attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736" } ], "revoked": true, "stix_id": "attack-pattern--f4882e23-8aa7-4b12-b28a-b349c12ee9e0" }, { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1094/", "created": "2017-05-31T21:31:10.314Z", "deprecated": false, "matched": true, "mitre_id": "T1094", "modified": "2025-10-24T17:49:37.745Z", "official_name": "Custom Command and Control Protocol", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0011", "name": "Command and Control", "shortname": "command-and-control" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1095/", "mitre_id": "T1095", "official_name": "Non-Application Layer Protocol", "official_status": "active", "relationship_id": "relationship--e4a43af9-e8f0-42cf-a707-b2393efb44f5", "stix_id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b" } ], "revoked": true, "stix_id": "attack-pattern--f72eb8a8-cd4c-461d-a814-3f862befbf00" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-16T07:16:35.438Z", "created_at": "2026-09-26T11:25:13.575Z", "modified": "2026-09-26T11:25:15.092Z", "published": "2026-09-16T07:16:35.438Z", "updated_at": "2026-09-26T11:25:15.092Z" }, "description_available": true, "id": "d8294ede-aa71-46ee-a778-5fe2e977e8a1", "is_inferred": false, "labels": [ "beacon", "c2 framework", "cobalt strike", "edr evasion", "pivotpipe" ], "lang": "en", "name": "PIVOTPIPE: A New .NET-based Unofficial Beacon Payload", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-16T07:16:35.438Z", "references": [ { "external_id": null, "id": "7161cff4-9961-413b-8fd5-dcf2c394d250", "source_name": "alien-vault", "url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/" }, { "external_id": "6aaa4253561ae21e60659c86", "id": "0dac7e8b-e011-44fe-8210-8c7a897c1e69", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aaa4253561ae21e60659c86" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/" }, "targets": [], "techniques": [], "vulnerabilities": [] }, "report_id": "d8294ede-aa71-46ee-a778-5fe2e977e8a1", "schema_version": 1, "selected_date": "2026-09-16", "source_url": "https://sect.iij.ad.jp/blog/2026/09/pivotpipe/" }