From 537ef0873555471e2dd98a9763a2251e4a2861c7 Mon Sep 17 00:00:00 2001 From: Mathieu Beligon Date: Mon, 16 Oct 2023 18:14:47 +0200 Subject: [PATCH 01/20] [threat-actors] Add Void Rabisu --- clusters/threat-actor.json | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index fc47ca3..23f6b65 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -11959,6 +11959,40 @@ ], "uuid": "32eebd31-5e0f-4fb9-b478-26ff4e48aaf4", "value": "AtlasCross" + }, + { + "description": "Void Rabisu is an intrusion set associated with both financially motivated ransomware attacks and targeted campaigns on Ukraine and countries supporting Ukraine.", + "meta": { + "cfr-suspected-victims": [ + "Ukraine", + "European Union" + ], + "references": [ + "https://www.trendmicro.com/en_us/research/23/j/void-rabisu-targets-female-leaders-with-new-romcom-variant.html", + "https://www.trendmicro.com/en_za/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html" + ], + "synonyms": [ + "Tropical Scorpius" + ] + }, + "related": [ + { + "dest-uuid": "6d9dfc5f-4ebf-404b-ab5e-e6497867fe65", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5f1c11d3-c6ac-4368-a801-cced88a9d93b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "uses" + } + ], + "uuid": "9766d52e-0e5d-4997-9c31-7f2291dcda9e", + "value": "Void Rabisu" } ], "version": 285 From f234f1e5a4248c867374bd374d45cb68b9892a7a Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 17 Oct 2023 11:20:18 +0200 Subject: [PATCH 02/20] chg: [doc] Index updated --- README.md | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 64bcb7c..4bf8f30 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,14 @@ Category: *actor* - source: *https://apt.360.net/aptlist* - total: *42* elements [[HTML](https://www.misp-project.org/galaxy.html#_360.net_threat_actors)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/360net.json)] +## Ammunitions + +[Ammunitions](https://www.misp-project.org/galaxy.html#_ammunitions) - Common ammunitions galaxy + +Category: *firearm* - source: *https://ammo.com/* - total: *410* elements + +[[HTML](https://www.misp-project.org/galaxy.html#_ammunitions)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/ammunitions.json)] + ## Android [Android](https://www.misp-project.org/galaxy.html#_android) - Android malware galaxy based on multiple open sources. @@ -55,7 +63,7 @@ Category: *guidelines* - source: *Open Sources* - total: *71* elements [Backdoor](https://www.misp-project.org/galaxy.html#_backdoor) - A list of backdoor malware. -Category: *tool* - source: *Open Sources* - total: *16* elements +Category: *tool* - source: *Open Sources* - total: *23* elements [[HTML](https://www.misp-project.org/galaxy.html#_backdoor)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/backdoor.json)] @@ -147,6 +155,14 @@ Category: *tool* - source: *MISP Project* - total: *52* elements [[HTML](https://www.misp-project.org/galaxy.html#_exploit-kit)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/exploit-kit.json)] +## Firearms + +[Firearms](https://www.misp-project.org/galaxy.html#_firearms) - Common firearms galaxy + +Category: *firearm* - source: *https://www.impactguns.com* - total: *5953* elements + +[[HTML](https://www.misp-project.org/galaxy.html#_firearms)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/firearms.json)] + ## FIRST DNS Abuse Techniques Matrix [FIRST DNS Abuse Techniques Matrix](https://www.misp-project.org/galaxy.html#_first_dns_abuse_techniques_matrix) - The Domain Name System (DNS) is a critical part of the Internet, including mapping domain names to IP addresses. Malicious threat actors use domain names, their corresponding technical resources, and other parts of the DNS infrastructure, including its protocols, for their malicious cyber operations. CERTs are confronted with reported DNS abuse on a continuous basis, and rely heavily on DNS analysis and infrastructure to protect their constituencies. Understanding the international customary norms applicable for detecting and mitigating DNS abuse from the perspective of the global incident response community is critical for the open Internet’s stability, security and resiliency. See also https://www.first.org/global/sigs/dns/ for more information. @@ -159,7 +175,7 @@ Category: *first-dns* - source: *https://www.first.org/global/sigs/dns/* - total [Malpedia](https://www.misp-project.org/galaxy.html#_malpedia) - Malware galaxy cluster based on Malpedia. -Category: *tool* - source: *Malpedia* - total: *2823* elements +Category: *tool* - source: *Malpedia* - total: *2947* elements [[HTML](https://www.misp-project.org/galaxy.html#_malpedia)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/malpedia.json)] @@ -423,7 +439,7 @@ Category: *rsit* - source: *https://github.com/enisaeu/Reference-Security-Incide [Sector](https://www.misp-project.org/galaxy.html#_sector) - Activity sectors -Category: *sector* - source: *CERT-EU* - total: *117* elements +Category: *sector* - source: *CERT-EU* - total: *118* elements [[HTML](https://www.misp-project.org/galaxy.html#_sector)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/sector.json)] @@ -431,7 +447,7 @@ Category: *sector* - source: *CERT-EU* - total: *117* elements [Sigma-Rules](https://www.misp-project.org/galaxy.html#_sigma-rules) - MISP galaxy cluster based on Sigma Rules. -Category: *rules* - source: *https://github.com/jstnk9/MISP/tree/main/misp-galaxy/sigma* - total: *2568* elements +Category: *rules* - source: *https://github.com/jstnk9/MISP/tree/main/misp-galaxy/sigma* - total: *2776* elements [[HTML](https://www.misp-project.org/galaxy.html#_sigma-rules)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/sigma-rules.json)] @@ -495,7 +511,7 @@ Category: *tea-matrix* - source: ** - total: *7* elements [Threat Actor](https://www.misp-project.org/galaxy.html#_threat_actor) - Known or estimated adversary groups targeting organizations and employees. Adversary groups are regularly confused with their initial operation or campaign. threat-actor-classification meta can be used to clarify the understanding of the threat-actor if also considered as operation, campaign or activity group. -Category: *actor* - source: *MISP Project* - total: *420* elements +Category: *actor* - source: *MISP Project* - total: *432* elements [[HTML](https://www.misp-project.org/galaxy.html#_threat_actor)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/threat-actor.json)] @@ -503,7 +519,7 @@ Category: *actor* - source: *MISP Project* - total: *420* elements [Tool](https://www.misp-project.org/galaxy.html#_tool) - threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries. -Category: *tool* - source: *MISP Project* - total: *557* elements +Category: *tool* - source: *MISP Project* - total: *585* elements [[HTML](https://www.misp-project.org/galaxy.html#_tool)] - [[JSON](https://github.com/MISP/misp-galaxy/blob/main/clusters/tool.json)] From e086bee02e0d897974260b0c27c19de3c6644d9e Mon Sep 17 00:00:00 2001 From: Mathieu Beligon Date: Tue, 17 Oct 2023 11:21:48 +0200 Subject: [PATCH 03/20] [threat-actors] More aliases of iranian apts --- clusters/threat-actor.json | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index fc47ca3..0835ead 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -6246,13 +6246,19 @@ "https://securityaffairs.co/wordpress/56348/intelligence/magic-hound-campaign.html", "https://www.cfr.org/cyber-operations/apt-35", "https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/", - "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/" + "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/", + "https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021/", + "https://www.sentinelone.com/labs/log4j2-in-the-wild-iranian-aligned-threat-actor-tunnelvision-actively-exploiting-vmware-horizon/", + "https://www.secureworks.com/blog/cobalt-mirage-conducts-ransomware-operations-in-us" ], "synonyms": [ "Newscaster Team", "Magic Hound", "G0059", - "Phosphorus" + "Phosphorus", + "Mint Sandstorm", + "TunnelVision", + "COBALT MIRAGE" ] }, "related": [ @@ -11573,7 +11579,8 @@ "https://www.microsoft.com/en-us/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/" ], "synonyms": [ - "Nemesis Kitten" + "Nemesis Kitten", + "Storm-0270" ] }, "related": [ From 75d950f1cb27ccff70c7cf222208d4fb52994cc7 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 17 Oct 2023 11:23:26 +0200 Subject: [PATCH 04/20] chg: [sigma] updated --- clusters/sigma-rules.json | 10211 ++++++++++++++++++------------------ 1 file changed, 5223 insertions(+), 4988 deletions(-) diff --git a/clusters/sigma-rules.json b/clusters/sigma-rules.json index 7e1bdb1..ed7c795 100644 --- a/clusters/sigma-rules.json +++ b/clusters/sigma-rules.json @@ -76,8 +76,8 @@ "logsource.category": "firewall", "logsource.product": "No established product", "refs": [ - "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", + "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.cisecurity.org/controls/cis-controls-list/", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/firewall/net_firewall_cleartext_protocols.yml" ], @@ -99,8 +99,8 @@ "logsource.category": "firewall", "logsource.product": "No established product", "refs": [ - "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation", "https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195", + "https://steemit.com/shadowbrokers/@theshadowbrokers/lost-in-translation", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/firewall/net_firewall_apt_equationgroup_c2.yml" ], "tags": [ @@ -134,10 +134,10 @@ "logsource.category": "dns", "logsource.product": "No established product", "refs": [ - "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/", - "https://core.telegram.org/bots/faq", "https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/", "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/", + "https://core.telegram.org/bots/faq", + "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/dns/net_dns_susp_telegram_api.yml" ], "tags": [ @@ -212,8 +212,8 @@ "logsource.category": "dns", "logsource.product": "No established product", "refs": [ - "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns", "https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/", + "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/dns/net_dns_mal_cobaltstrike.yml" ], "tags": [ @@ -246,8 +246,8 @@ "logsource.category": "dns", "logsource.product": "No established product", "refs": [ - "https://twitter.com/stvemillertime/status/1024707932447854592", "https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Backdoors/DNS_TXT_Pwnage.ps1", + "https://twitter.com/stvemillertime/status/1024707932447854592", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/dns/net_dns_susp_txt_exec_strings.yml" ], "tags": [ @@ -1209,9 +1209,9 @@ "logsource.category": "No established category", "logsource.product": "zeek", "refs": [ - "https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf", "https://msrc.microsoft.com/update-guide/vulnerability/ADV210003", "https://github.com/topotam/PetitPotam/blob/d83ac8f2dd34654628c17490f99106eb128e7d1e/PetitPotam/PetitPotam.cpp", + "https://vx-underground.org/archive/Symantec/windows-vista-network-attack-07-en.pdf", "https://threatpost.com/microsoft-petitpotam-poc/168163/", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_potential_petit_potam_efs_rpc_call.yml" ], @@ -1649,9 +1649,9 @@ "logsource.category": "No established category", "logsource.product": "zeek", "refs": [ - "https://twitter.com/_dirkjan/status/1309214379003588608", - "https://dirkjanm.io/a-different-way-of-abusing-zerologon/", "https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1", + "https://dirkjanm.io/a-different-way-of-abusing-zerologon/", + "https://twitter.com/_dirkjan/status/1309214379003588608", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_smb_spoolss_named_pipe.yml" ], "tags": [ @@ -1726,12 +1726,12 @@ "logsource.category": "No established category", "logsource.product": "zeek", "refs": [ - "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", - "https://github.com/zeek/zeek/blob/691b099de13649d6576c7b9d637f8213ff818832/scripts/base/protocols/dce-rpc/consts.zeek", - "https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/", - "https://old.zeek.org/zeekweek2019/slides/bzar.pdf", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29", "https://github.com/corelight/CVE-2021-1675", + "https://old.zeek.org/zeekweek2019/slides/bzar.pdf", + "https://github.com/zeek/zeek/blob/691b099de13649d6576c7b9d637f8213ff818832/scripts/base/protocols/dce-rpc/consts.zeek", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29", + "https://www.crowdstrike.com/blog/cve-2021-1678-printer-spooler-relay-security-advisory/", + "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dce_rpc_printnightmare_print_driver_install.yml" ], "tags": [ @@ -1863,10 +1863,10 @@ "logsource.category": "No established category", "logsource.product": "zeek", "refs": [ - "https://twitter.com/neu5ron/status/1346245602502443009", - "https://tools.ietf.org/html/rfc2929#section-2.1", - "https://www.netresec.com/?page=Blog&month=2021-01&post=Finding-Targeted-SUNBURST-Victims-with-pDNS", "https://tdm.socprime.com/tdm/info/eLbyj4JjI15v#sigma", + "https://www.netresec.com/?page=Blog&month=2021-01&post=Finding-Targeted-SUNBURST-Victims-with-pDNS", + "https://tools.ietf.org/html/rfc2929#section-2.1", + "https://twitter.com/neu5ron/status/1346245602502443009", "https://github.com/SigmaHQ/sigma/tree/master/rules/network/zeek/zeek_dns_susp_zbit_flag.yml" ], "tags": [ @@ -2007,8 +2007,8 @@ "logsource.category": "application", "logsource.product": "spring", "refs": [ - "https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection", "https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs", + "https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/spring/spring_spel_injection.yml" ], "tags": [ @@ -2277,10 +2277,10 @@ "logsource.category": "application", "logsource.product": "ruby_on_rails", "refs": [ - "https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb", - "https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception", "http://edgeguides.rubyonrails.org/security.html", "http://guides.rubyonrails.org/action_controller_overview.html", + "https://stackoverflow.com/questions/25892194/does-rails-come-with-a-not-authorized-exception", + "https://github.com/rails/rails/blob/cd08e6bcc4cd8948fe01e0be1ea0c7ca60373a25/actionpack/lib/action_dispatch/middleware/exception_wrapper.rb", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/ruby/appframework_ruby_on_rails_exceptions.yml" ], "tags": [ @@ -2314,9 +2314,9 @@ "logsource.product": "rpc_firewall", "refs": [ "https://github.com/zeronetworks/rpcfirewall", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3", "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-WKST.md", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_account.yml" ], "tags": [ @@ -2350,9 +2350,9 @@ "logsource.product": "rpc_firewall", "refs": [ "https://github.com/zeronetworks/rpcfirewall", - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_registry_recon.yml" ], "tags": [ @@ -2375,10 +2375,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://github.com/zeronetworks/rpcfirewall", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_recon.yml" ], "tags": [ @@ -2401,10 +2401,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/zeronetworks/rpcfirewall", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9", "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SCMR.md", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/zeronetworks/rpcfirewall", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_service_lateral_movement.yml" ], "tags": [ @@ -2437,10 +2437,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://github.com/zeronetworks/rpcfirewall", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_atsvc_lateral_movement.yml" ], "tags": [ @@ -2481,8 +2481,8 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN", "https://github.com/zeronetworks/rpcfirewall", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN", "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-DRSR.md", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_dcsync_attack.yml" @@ -2541,10 +2541,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://github.com/zeronetworks/rpcfirewall", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_itaskschedulerservice_lateral_movement.yml" ], "tags": [ @@ -2585,8 +2585,8 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/zeronetworks/rpcfirewall", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9", + "https://github.com/zeronetworks/rpcfirewall", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_dcom_or_wmi.yml" ], @@ -2628,10 +2628,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://github.com/zeronetworks/rpcfirewall", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sasec_lateral_movement.yml" ], "tags": [ @@ -2673,10 +2673,10 @@ "logsource.product": "rpc_firewall", "refs": [ "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RPRN-PAR.md", - "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", - "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", "https://github.com/zeronetworks/rpcfirewall", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8", + "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_printing_lateral_movement.yml" ], @@ -2700,10 +2700,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/zeronetworks/rpcfirewall", - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183", + "https://github.com/zeronetworks/rpcfirewall", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sharphound_recon_sessions.yml" ], "tags": [ @@ -2736,9 +2736,9 @@ "logsource.product": "rpc_firewall", "refs": [ "https://github.com/zeronetworks/rpcfirewall", + "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-EFSR.md", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942", - "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_efs_abuse.yml" ], "tags": [ @@ -2761,10 +2761,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://github.com/zeronetworks/rpcfirewall", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_sasec_recon.yml" ], "tags": [ @@ -2788,9 +2788,9 @@ "logsource.product": "rpc_firewall", "refs": [ "https://github.com/zeronetworks/rpcfirewall", - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-RRP.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_registry_lateral_movement.yml" ], "tags": [ @@ -2823,10 +2823,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/zeronetworks/rpcfirewall", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9", - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md", + "https://github.com/zeronetworks/rpcfirewall", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-SRVS.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_remote_server_service_abuse.yml" ], "tags": [ @@ -2849,10 +2849,10 @@ "logsource.category": "application", "logsource.product": "rpc_firewall", "refs": [ - "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://github.com/zeronetworks/rpcfirewall", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931", "https://zeronetworks.com/blog/stopping-lateral-movement-via-the-rpc-firewall/", + "https://github.com/jsecurity101/MSRPC-to-ATTACK/blob/ddd4608fe8684fcf2fcf9b48c5f0b3c28097f8a3/documents/MS-TSCH.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/rpc_firewall/rpc_firewall_atsvc_recon.yml" ], "tags": [ @@ -2876,8 +2876,8 @@ "logsource.category": "application", "logsource.product": "velocity", "refs": [ - "https://antgarsil.github.io/posts/velocity/", "https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs", + "https://antgarsil.github.io/posts/velocity/", "https://github.com/SigmaHQ/sigma/tree/master/rules/application/velocity/velocity_ssti_injection.yml" ], "tags": [ @@ -2943,10 +2943,10 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ - "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow", + "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_susp_proc_access_lsass_susp_source.yml" ], @@ -2981,8 +2981,8 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ - "https://twitter.com/shantanukhande/status/1229348874298388484", "https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/", + "https://twitter.com/shantanukhande/status/1229348874298388484", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_dump_comsvcs_dll.yml" ], "tags": [ @@ -3418,10 +3418,10 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ - "https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md", - "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://research.splunk.com/endpoint/windows_possible_credential_dumping/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.001/T1003.001.md", + "https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html", + "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_lsass_memdump.yml" ], "tags": [ @@ -3455,10 +3455,10 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ + "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", - "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_cred_dump_lsass_access.yml" ], "tags": [ @@ -3493,10 +3493,10 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ - "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow", + "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_rare_proc_access_lsass.yml" ], @@ -3531,10 +3531,10 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ - "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://docs.microsoft.com/en-us/windows/win32/procthread/process-security-and-access-rights", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow", + "http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf", "https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_susp_proc_access_lsass.yml" ], @@ -3561,9 +3561,7 @@ "meta": { "author": "Christian Burkard (Nextron Systems), Tim Shelton", "creation_date": "2021/07/28", - "falsepositive": [ - "Unknown" - ], + "falsepositive": "No established falsepositives", "filename": "proc_access_win_direct_syscall_ntopenprocess.yml", "level": "high", "logsource.category": "process_access", @@ -3787,9 +3785,9 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ + "https://github.com/codewhitesec/SysmonEnte/blob/main/screens/1.png", "https://codewhitesec.blogspot.com/2022/09/attacks-on-sysmon-revisited-sysmonente.html", "https://github.com/codewhitesec/SysmonEnte/", - "https://github.com/codewhitesec/SysmonEnte/blob/main/screens/1.png", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_hack_sysmonente.yml" ], "tags": [ @@ -3822,8 +3820,8 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ - "https://github.com/boku7/injectAmsiBypass", "https://github.com/boku7/spawn", + "https://github.com/boku7/injectAmsiBypass", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_cobaltstrike_bof_injection_pattern.yml" ], "tags": [ @@ -3865,9 +3863,9 @@ "logsource.category": "process_access", "logsource.product": "windows", "refs": [ - "https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml", - "https://twitter.com/SBousseaden/status/1541920424635912196", "https://splintercod3.blogspot.com/p/the-hidden-side-of-seclogon-part-3.html", + "https://twitter.com/SBousseaden/status/1541920424635912196", + "https://github.com/elastic/detection-rules/blob/2bc1795f3d7bcc3946452eb4f07ae799a756d94e/rules/windows/credential_access_lsass_handle_via_malseclogon.toml", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_access/proc_access_win_susp_seclogon.yml" ], "tags": [ @@ -3900,8 +3898,8 @@ "logsource.category": "process_tampering", "logsource.product": "windows", "refs": [ - "https://twitter.com/SecurePeacock/status/1486054048390332423?s=20", "https://www.bleepingcomputer.com/news/microsoft/microsoft-sysmon-now-detects-malware-process-tampering-attempts/", + "https://twitter.com/SecurePeacock/status/1486054048390332423?s=20", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_tampering/proc_tampering_process_hollowing.yml" ], "tags": [ @@ -4096,10 +4094,10 @@ "logsource.category": "pipe_created", "logsource.product": "windows", "refs": [ - "https://github.com/SigmaHQ/sigma/issues/253", - "https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/", "https://redcanary.com/threat-detection-report/threats/cobalt-strike/", "https://twitter.com/d4rksystem/status/1357010969264873472", + "https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/", + "https://github.com/SigmaHQ/sigma/issues/253", "https://labs.f-secure.com/blog/detecting-cobalt-strike-default-modules-via-named-pipe-analysis/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike.yml" ], @@ -4145,7 +4143,7 @@ "value": "HackTool - DiagTrackEoP Default Named Pipe" }, { - "description": "Detects the pattern of a pipe name as used by the hacktool EfsPotato", + "description": "Detects the pattern of a pipe name as used by the hack tool EfsPotato", "meta": { "author": "Florian Roth (Nextron Systems)", "creation_date": "2021/08/23", @@ -4259,8 +4257,8 @@ "logsource.category": "pipe_created", "logsource.product": "windows", "refs": [ - "https://github.com/kavika13/RemCom", "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view", + "https://github.com/kavika13/RemCom", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_remcom_default_pipe.yml" ], "tags": [ @@ -4336,17 +4334,17 @@ "logsource.category": "pipe_created", "logsource.product": "windows", "refs": [ - "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", - "https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a", - "https://github.com/RiccardoAncarani/LiquidSnake", "https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/", - "https://securelist.com/faq-the-projectsauron-apt/75533/", - "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf", + "https://us-cert.cisa.gov/ncas/analysis-reports/ar19-304a", + "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity", "https://www.us-cert.gov/ncas/alerts/TA17-117A", - "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", - "https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf", + "https://securelist.com/faq-the-projectsauron-apt/75533/", "https://thedfirreport.com/2020/06/21/snatch-ransomware/", + "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", + "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf", + "https://download.bitdefender.com/resources/files/News/CaseStudies/study/115/Bitdefender-Whitepaper-PAC-A4-en-EN1.pdf", + "https://github.com/RiccardoAncarani/LiquidSnake", "https://securelist.com/wild-neutron-economic-espionage-threat-actor-returns-with-new-tricks/71275/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_mal_namedpipes.yml" ], @@ -4381,8 +4379,8 @@ "logsource.category": "pipe_created", "logsource.product": "windows", "refs": [ - "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575", "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752", + "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_susp_pipe_patterns.yml" ], "tags": [ @@ -4416,8 +4414,8 @@ "logsource.category": "pipe_created", "logsource.product": "windows", "refs": [ - "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://image.slidesharecdn.com/zeronights2017kheirkhabarov-171118103000/75/hunting-for-credentials-dumping-in-windows-environment-57-2048.jpg?cb=1666035799", + "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_generic_cred_dump_tools_pipes.yml" ], "tags": [ @@ -4474,8 +4472,8 @@ "logsource.category": "pipe_created", "logsource.product": "windows", "refs": [ - "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view", "https://github.com/malcomvetter/CSExec", + "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_csexec_default_pipe.yml" ], "tags": [ @@ -4560,8 +4558,8 @@ "logsource.product": "windows", "refs": [ "https://github.com/Azure/Azure-Sentinel/blob/f99542b94afe0ad2f19a82cc08262e7ac8e1428e/Detections/SecurityEvent/ADFSDBNamedPipeConnection.yaml", - "https://github.com/Azure/SimuLand", "https://o365blog.com/post/adfs/", + "https://github.com/Azure/SimuLand", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_susp_adfs_namedpipe_connection.yml" ], "tags": [ @@ -4627,8 +4625,8 @@ "logsource.category": "pipe_created", "logsource.product": "windows", "refs": [ - "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575", "https://gist.github.com/MHaggis/6c600e524045a6d49c35291a21e10752", + "https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_cobaltstrike_re.yml" ], "tags": [ @@ -4649,6 +4647,41 @@ "uuid": "0e7163d4-9e19-4fa7-9be6-000c61aad77a", "value": "CobaltStrike Named Pipe Pattern Regex" }, + { + "description": "Detects the pattern of a pipe name as used by the hack tool CoercedPotato", + "meta": { + "author": "Florian Roth (Nextron Systems)", + "creation_date": "2023/10/11", + "falsepositive": [ + "Unknown" + ], + "filename": "pipe_created_hktl_coercedpotato.yml", + "level": "high", + "logsource.category": "pipe_created", + "logsource.product": "windows", + "refs": [ + "https://github.com/hackvens/CoercedPotato", + "https://blog.hackvens.fr/articles/CoercedPotato.html", + "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/pipe_created/pipe_created_hktl_coercedpotato.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.privilege_escalation", + "attack.t1055" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "4d0083b3-580b-40da-9bba-626c19fe4033", + "value": "HackTool - CoercedPotato Named Pipe Creation" + }, { "description": "Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack", "meta": { @@ -4791,8 +4824,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)", + "https://app.any.run/tasks/7123e948-c91e-49e0-a813-00e8d72ab393/#", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_susp_folder.yml" ], "tags": [ @@ -5191,9 +5224,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore", "https://twitter.com/MsftSecIntel/status/1257324139515269121", "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image", + "https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore", "https://www.proofpoint.com/us/blog/threat-insight/threat-actor-profile-ta2719-uses-colorful-lures-deliver-rats-local-languages", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_iso_mount.yml" ], @@ -5227,8 +5260,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699", "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4701", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4699", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_scheduled_task_delete_or_disable.yml" ], "tags": [ @@ -5342,7 +5375,7 @@ "Legitimate software accessing LSASS process for legitimate reason; update the whitelist with it" ], "filename": "win_security_susp_lsass_dump_generic.yml", - "level": "high", + "level": "medium", "logsource.category": "No established category", "logsource.product": "windows", "refs": [ @@ -5366,7 +5399,7 @@ } ], "uuid": "4a1b6da0-d94f-4fc3-98fc-2d9cb9e5ee76", - "value": "Generic Password Dumper Activity on LSASS" + "value": "Potentially Suspicious AccessMask Requested From LSASS" }, { "description": "Detects when the password policy is enumerated.", @@ -5379,8 +5412,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951", "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4661", + "https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_password_policy_enumerated.yml" ], "tags": [ @@ -5413,8 +5446,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423", "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-6423", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_device_installation_blocked.yml" ], "tags": [ @@ -5480,8 +5513,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672", "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4672", "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4964", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_admin_logon.yml" ], @@ -5567,8 +5600,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/", "https://twitter.com/mattifestation/status/899646620148539397", + "https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_wmi_persistence.yml" ], "tags": [ @@ -5703,11 +5736,11 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776", "https://github.com/staaldraad/go-ntlm/blob/cd032d41aa8ce5751c07cb7945400c0f5c81e2eb/ntlm/ntlmv1.go#L427", + "https://github.com/sensepost/ruler", "https://github.com/sensepost/ruler/issues/47", "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624", - "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4776", - "https://github.com/sensepost/ruler", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_alert_ruler.yml" ], "tags": [ @@ -5797,9 +5830,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html", "https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf", "https://awakesecurity.com/blog/threat-hunting-for-paexec/", + "https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_mal_service_installs.yml" ], "tags": [ @@ -5992,9 +6025,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634", "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647", - "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_user_logoff.yml" ], "tags": "No established tags" @@ -6047,9 +6080,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-gb/sysinternals/downloads/sdelete", - "https://www.jpcert.or.jp/english/pub/sr/ir_research.html", "https://jpcertcc.github.io/ToolAnalysisResultSheet/details/sdelete.htm", + "https://www.jpcert.or.jp/english/pub/sr/ir_research.html", + "https://docs.microsoft.com/en-gb/sysinternals/downloads/sdelete", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_sdelete.yml" ], "tags": [ @@ -6168,9 +6201,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/_dirkjan/status/1309214379003588608", - "https://dirkjanm.io/a-different-way-of-abusing-zerologon/", "https://posts.specterops.io/hunting-in-active-directory-unconstrained-delegation-forests-trusts-71f2b33688e1", + "https://dirkjanm.io/a-different-way-of-abusing-zerologon/", + "https://twitter.com/_dirkjan/status/1309214379003588608", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_dce_rpc_smb_spoolss_named_pipe.yml" ], "tags": [ @@ -6510,9 +6543,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/", "https://github.com/fox-it/LDAPFragger", "https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961", - "https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_ldap_dataexchange.yml" ], "tags": [ @@ -6799,9 +6832,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "Live environment caused by malware", - "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616", "Private Cuckoo Sandbox (from many years ago, no longer have hash, NDA as well)", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4616", + "Live environment caused by malware", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_time_modification.yml" ], "tags": [ @@ -6941,8 +6974,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness", "https://center-for-threat-informed-defense.github.io/summiting-the-pyramid/analytics/service_registry_permissions_weakness_check/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_registry_permissions_weakness_check.yml" ], "tags": [ @@ -7051,8 +7084,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/menasec1/status/1111556090137903104", "https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf", + "https://twitter.com/menasec1/status/1111556090137903104", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml" ], "tags": [ @@ -7151,8 +7184,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/SigmaHQ/sigma/blob/master/documentation/logsource-guides/windows/service/security.md", "https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit", + "https://github.com/SigmaHQ/sigma/blob/master/documentation/logsource-guides/windows/service/security.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_disable_event_auditing_critical.yml" ], "tags": [ @@ -7415,9 +7448,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8", - "https://twitter.com/SecurityJosh/status/1283027365770276866", "https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html", + "https://twitter.com/SecurityJosh/status/1283027365770276866", + "https://gist.github.com/Cyb3rWard0g/cf08c38c61f7e46e8404b38201ca01c8", "https://twitter.com/Flangvik/status/1283054508084473861", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_sysmon_channel_reference_deletion.yml" ], @@ -7732,8 +7765,8 @@ "logsource.product": "windows", "refs": [ "https://github.com/topotam/PetitPotam", - "https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/", "https://github.com/splunk/security_content/blob/develop/detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml", + "https://isc.sans.edu/forums/diary/Active+Directory+Certificate+Services+ADCS+PKI+domain+admin+vulnerability/27668/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_petitpotam_susp_tgt_request.yml" ], "tags": [ @@ -7842,8 +7875,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/", "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment", + "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install.yml" ], "tags": [ @@ -7885,8 +7918,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity", "https://adsecurity.org/?p=3458", + "https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_rc4_kerberos.yml" ], "tags": [ @@ -8026,9 +8059,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743", "https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md", "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4741", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4743", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_add_remove_computer.yml" ], "tags": [ @@ -8419,9 +8452,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4800", - "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://www.cisecurity.org/controls/cis-controls-list/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_workstation_was_locked.yml" ], @@ -8443,16 +8476,16 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38", - "http://managed670.rssing.com/chan-5590147/all_p1.html", "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf", + "http://managed670.rssing.com/chan-5590147/all_p1.html", + "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38", "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables", "https://bunnyinside.com/?term=f71e8cb9c76a", - "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39", - "https://twitter.com/_xpn_/status/1268712093928378368", - "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_", - "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr", "https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code", + "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr", + "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39", + "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_", + "https://twitter.com/_xpn_/status/1268712093928378368", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_dot_net_etw_tamper.yml" ], "tags": [ @@ -8757,8 +8790,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://blog.harmj0y.net/redteaming/another-word-on-delegation/", "https://adsecurity.org/?p=2053", + "https://blog.harmj0y.net/redteaming/another-word-on-delegation/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_alert_enable_weak_encryption.yml" ], "tags": [ @@ -8915,8 +8948,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file", "https://github.com/OTRF/ThreatHunter-Playbook/blob/f7a58156dbfc9b019f17f638b8c62d22e557d350/playbooks/WIN-201012004336.yaml", + "https://securitydatasets.com/notebooks/atomic/windows/lateral_movement/SDWIN-200806015757.html?highlight=create%20file", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_smb_file_creation_admin_shares.yml" ], "tags": [ @@ -8949,8 +8982,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072", "https://twitter.com/duzvik/status/1269671601852813320", + "https://medium.com/@7a616368/can-you-track-processes-accessing-the-camera-and-microphone-7e6885b37072", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_camera_microphone_access.yml" ], "tags": [ @@ -9017,8 +9050,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows/win32/adschema/attributes-all", "https://www.specterops.io/assets/resources/an_ace_up_the_sleeve.pdf", + "https://docs.microsoft.com/en-us/windows/win32/adschema/attributes-all", "http://www.stuffithoughtiknew.com/2019/02/detecting-bloodhound.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_ad_user_enumeration.yml" ], @@ -9052,9 +9085,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://blog.harmj0y.net/redteaming/another-word-on-delegation/", "https://adsecurity.org/?p=3466", "https://msdn.microsoft.com/en-us/library/cc220234.aspx", + "https://blog.harmj0y.net/redteaming/another-word-on-delegation/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml" ], "tags": [ @@ -9088,8 +9121,8 @@ "logsource.product": "windows", "refs": [ "https://cyberstoph.org/posts/2022/03/detecting-shadow-credentials/", - "https://twitter.com/SBousseaden/status/1581300963650187264?", "https://www.elastic.co/guide/en/security/8.4/potential-shadow-credentials-added-to-ad-object.html", + "https://twitter.com/SBousseaden/status/1581300963650187264?", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_possible_shadow_credentials_added.yml" ], "tags": [ @@ -9157,9 +9190,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/", - "https://www.sans.org/webcasts/119395", "https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/", + "https://www.sans.org/webcasts/119395", + "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_cobaltstrike_service_installs.yml" ], "tags": [ @@ -9243,8 +9276,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/gentilkiwi/status/1003236624925413376", "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662", + "https://twitter.com/gentilkiwi/status/1003236624925413376", "https://gist.github.com/gentilkiwi/dcc132457408cf11ad2061340dcb53c2", "https://blog.blacklanternsecurity.com/p/detecting-dcsync?s=r", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_dcsync.yml" @@ -9280,8 +9313,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625", "https://twitter.com/SBousseaden/status/1101431884540710913", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_failed_logon_reasons.yml" ], "tags": [ @@ -9317,8 +9350,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/SBousseaden/status/1490608838701166596", "https://www.elastic.co/guide/en/security/current/windows-service-installed-via-an-unusual-client.html", + "https://twitter.com/SBousseaden/status/1490608838701166596", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_service_installation_by_unusal_client.yml" ], "tags": [ @@ -9384,9 +9417,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://github.com/WazeHell/sam-theadmin/blob/main/sam_the_admin.py", "https://twitter.com/malmoeb/status/1511760068743766026", "https://github.com/helloexp/0day/blob/614227a7b9beb0e91e7e2c6a5e532e6f7a8e883c/00-CVE_EXP/CVE-2021-42287/sam-the-admin/sam_the_admin.py", - "https://github.com/WazeHell/sam-theadmin/blob/main/sam_the_admin.py", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/win_security_susp_computer_name.yml" ], "tags": [ @@ -9522,8 +9555,8 @@ "logsource.product": "windows", "refs": [ "https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events", - "https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/", "https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis", + "https://blog.stealthbits.com/how-to-detect-pass-the-hash-attacks/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_pass_the_hash_2.yml" ], "tags": [ @@ -9615,8 +9648,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html", "https://twitter.com/Purp1eW0lf/status/1616144561965002752", + "https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_smb_login.yml" ], "tags": [ @@ -9750,11 +9783,11 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=634", + "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730", + "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.cisecurity.org/controls/cis-controls-list/", - "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4730", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml" ], "tags": [ @@ -9855,11 +9888,11 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633", "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4729", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.cisecurity.org/controls/cis-controls-list/", - "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=633", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml" ], "tags": [ @@ -9996,8 +10029,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html", "https://twitter.com/Purp1eW0lf/status/1616144561965002752", + "https://www.inversecos.com/2020/04/successful-4624-anonymous-logons-to.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_successful_external_remote_rdp_login.yml" ], "tags": [ @@ -10081,11 +10114,11 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", - "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632", - "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4728", "https://www.cisecurity.org/controls/cis-controls-list/", + "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=632", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml" ], "tags": [ @@ -10361,11 +10394,11 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/FlemmingRiis/status/1217147415482060800", - "https://twitter.com/DidierStevens/status/1217533958096924676", "https://twitter.com/VM_vivisector/status/1217190929330655232", - "https://nullsec.us/windows-event-log-audit-cve/", + "https://twitter.com/DidierStevens/status/1217533958096924676", "https://www.youtube.com/watch?v=ebmW42YYveI", + "https://nullsec.us/windows-event-log-audit-cve/", + "https://twitter.com/FlemmingRiis/status/1217147415482060800", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml" ], "tags": [ @@ -10443,8 +10476,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx", "https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100", + "https://technet.microsoft.com/en-us/library/cc742154(v=ws.11).aspx", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/microsoft_windows_backup/win_susp_backup_delete.yml" ], "tags": [ @@ -10561,8 +10594,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/deepinstinct/Lsass-Shtinkering", "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55", + "https://github.com/deepinstinct/Lsass-Shtinkering", "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/application_error/win_werfault_susp_lsass_credential_dump.yml" ], @@ -10630,9 +10663,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31", "https://www.virustotal.com/gui/file/5092b2672b4cb87a8dd1c2e6047b487b95995ad8ed5e9fc217f46b8bfb1b8c01", "https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed", + "https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/Other/win_av_relevant_match.yml" ], "tags": [ @@ -10665,8 +10698,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling", "https://github.com/SigmaHQ/sigma/pull/4467", + "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_file_transfer.yml" ], "tags": [ @@ -10699,8 +10732,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling", "https://github.com/SigmaHQ/sigma/pull/4467", + "https://www.huntandhackett.com/blog/revil-the-usage-of-legitimate-remote-admin-tooling", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/screenconnect/win_app_remote_access_tools_screenconnect_command_exec.yml" ], "tags": [ @@ -10848,6 +10881,40 @@ "uuid": "570ae5ec-33dc-427c-b815-db86228ad43e", "value": "Application Uninstalled" }, + { + "description": "Detects failed logon attempts from clients to MSSQL server.", + "meta": { + "author": "Nasreddine Bencherchali (Nextron Systems), j4son", + "creation_date": "2023/10/11", + "falsepositive": [ + "This event could stem from users changing an account's password that's used to authenticate via a job or an automated process. Investigate the source of such events and mitigate them" + ], + "filename": "win_mssql_failed_logon.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "windows", + "refs": [ + "https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html", + "https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1110" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "218d2855-2bba-4f61-9c85-81d0ea63ac71", + "value": "MSSQL Server Failed Logon" + }, { "description": "Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started", "meta": { @@ -10861,8 +10928,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/", "https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16", + "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_sp_procoption_set.yml" ], "tags": [ @@ -10897,6 +10964,40 @@ "uuid": "d08dd86f-681e-4a00-a92c-1db218754417", "value": "MSSQL XPCmdshell Option Change" }, + { + "description": "Detects failed logon attempts from clients with external network IP to an MSSQL server. This can be a sign of a bruteforce attack.", + "meta": { + "author": "j4son", + "creation_date": "2023/10/11", + "falsepositive": [ + "Unknown" + ], + "filename": "win_mssql_failed_logon_from_external_network.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "windows", + "refs": [ + "https://www.experts-exchange.com/questions/27800944/EventID-18456-Failed-to-open-the-explicitly-specified-database.html", + "https://cybersecthreat.com/2020/07/08/enable-mssql-authentication-log-to-eventlog/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_failed_logon_from_external_network.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1110" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "ebfe73c2-5bc9-4ed9-aaa8-8b54b2b4777d", + "value": "MSSQL Server Failed Logon From External Network" + }, { "description": "Detects when the MSSQL \"xp_cmdshell\" stored procedure is used to execute commands", "meta": { @@ -10957,9 +11058,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16", - "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/", "https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16", + "https://www.netspi.com/blog/technical/network-penetration-testing/sql-server-persistence-part-1-startup-stored-procedures/", + "https://docs.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/application/mssqlserver/win_mssql_disable_audit_settings.yml" ], "tags": [ @@ -11213,9 +11314,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/event-id-explanations", "https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log", "https://twitter.com/SBousseaden/status/1483810148602814466", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/event-id-explanations", "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_attempted_dll_load.yml" ], @@ -11314,9 +11415,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/event-id-explanations", "https://github.com/MicrosoftDocs/windows-itpro-docs/blob/40fe118976734578f83e5e839b9c63ae7a4af82d/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md#windows-codeintegrity-operational-log", "https://twitter.com/wdormann/status/1590434950335320065", + "https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/event-id-explanations", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/code_integrity/win_codeintegrity_enforced_policy_block.yml" ], "tags": [ @@ -11409,9 +11510,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/KevTheHermit/status/1410203844064301056", "https://github.com/afwu/PrintNightmare", "https://github.com/hhlxf/PrintNightmare", + "https://twitter.com/KevTheHermit/status/1410203844064301056", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/smbclient/security/win_smbclient_security_susp_failed_guest_logon.yml" ], "tags": [ @@ -11467,11 +11568,11 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", "https://winaero.com/enable-openssh-server-windows-10/", + "https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH", "https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx", "https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse", - "https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16", - "https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml" ], "tags": [ @@ -11505,8 +11606,8 @@ "logsource.product": "windows", "refs": [ "https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection", - "https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml", "https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-identifiers", + "https://github.com/nasbench/EVTX-ETW-Resources/blob/7a806a148b3d9d381193d4a80356016e6e8b1ee8/ETWProvidersManifests/Windows11/22H2/W11_22H2_Pro_20221220_22621.963/WEPExplorer/LsaSrv.xml", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/lsa_server/win_lsa_server_normal_user_admin.yml" ], "tags": [ @@ -11554,8 +11655,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide", "https://bhabeshraj.com/post/tampering-with-microsoft-defenders-tamper-protection", + "https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/windefend/win_defender_tamper_protection_trigger.yml" ], "tags": [ @@ -11733,9 +11834,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/", "Internal Research", "https://gist.github.com/nasbench/33732d6705cbdc712fae356f07666346", - "https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/windefend/win_defender_real_time_protection_errors.yml" ], "tags": [ @@ -11891,8 +11992,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide", "https://bidouillesecurity.com/disable-windows-defender-in-powershell/#DisableAntiSpyware", + "https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/windefend/win_defender_suspicious_features_tampering.yml" ], "tags": [ @@ -12095,10 +12196,10 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", - "https://isc.sans.edu/diary/22264", "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/", + "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", + "https://isc.sans.edu/diary/22264", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_ip_address.yml" ], "tags": [ @@ -12166,8 +12267,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/malmoeb/status/1535142803075960832", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", + "https://twitter.com/malmoeb/status/1535142803075960832", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1197/T1197.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/bits_client/win_bits_client_new_transfer_via_file_sharing_domains.yml" ], @@ -12302,9 +12403,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ + "https://twitter.com/gentilkiwi/status/861641945944391680", "https://technet.microsoft.com/en-us/library/cc735829(v=ws.10).aspx", "https://medium.com/@esnesenon/feature-not-bug-dnsadmin-to-dc-compromise-in-one-line-a0f779b8dc83", - "https://twitter.com/gentilkiwi/status/861641945944391680", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/dns_server/win_dns_server_susp_server_level_plugin_dll.yml" ], "tags": [ @@ -12434,8 +12535,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/Ekultek/BlueKeep", "https://github.com/zerosum0x0/CVE-2019-0708", + "https://github.com/Ekultek/BlueKeep", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/termdd/win_system_rdp_potential_cve_2019_0708.yml" ], "tags": [ @@ -12525,9 +12626,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://twitter.com/wdormann/status/1347958161609809921", "https://twitter.com/jonasLyk/status/1347900440000811010", "https://www.bleepingcomputer.com/news/security/windows-10-bug-corrupts-your-hard-drive-on-seeing-this-files-icon/", + "https://twitter.com/wdormann/status/1347958161609809921", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/ntfs/win_system_ntfs_vuln_exploit.yml" ], "tags": [ @@ -12744,8 +12845,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/", "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment", + "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_meterpreter_or_cobaltstrike_getsystem_service_installation.yml" ], "tags": [ @@ -13211,9 +13312,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/", - "https://www.sans.org/webcasts/119395", "https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/", + "https://www.sans.org/webcasts/119395", + "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_cobaltstrike_service_installs.yml" ], "tags": [ @@ -13449,8 +13550,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/", "https://github.com/BishopFox/sliver/blob/79f2d48fcdfc2bee4713b78d431ea4b27f733f30/client/command/commands.go#L1231", + "https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sliver.yml" ], "tags": [ @@ -14460,6 +14561,30 @@ "uuid": "e6f81941-b1cd-4766-87db-9fc156f658ee", "value": "KDC RC4-HMAC Downgrade CVE-2022-37966" }, + { + "description": "Detects a user certificate that was valid but could not be mapped to a user in a strong way (such as via explicit mapping, key trust mapping, or a SID)\nThis could be a sign of exploitation of the elevation of privilege vulnerabilities (CVE-2022-34691, CVE-2022-26931, CVE-2022-26923) that can occur when the KDC allows certificate spoofing by not requiring a strong mapping.\nEvents where the AccountName and CN of the Subject do not match, or where the CN ends in a dollar sign indicating a machine, may indicate certificate spoofing.\n", + "meta": { + "author": "@br4dy5", + "creation_date": "2023/10/09", + "falsepositive": [ + "If prevalent in the environment, filter on events where the AccountName and CN of the Subject do not reference the same user", + "If prevalent in the environment, filter on CNs that end in a dollar sign indicating it is a machine name" + ], + "filename": "win_system_kdcsvc_cert_use_no_strong_mapping.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "windows", + "refs": [ + "https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16", + "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_kerberos_key_distribution_center/win_system_kdcsvc_cert_use_no_strong_mapping.yml" + ], + "tags": [ + "attack.privilege_escalation" + ] + }, + "uuid": "993c2665-e6ef-40e3-a62a-e1a97686af79", + "value": "Certificate Use With No Strong Mapping" + }, { "description": "This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded", "meta": { @@ -14473,8 +14598,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx", "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx", + "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx", "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config.yml" ], @@ -14508,8 +14633,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx", "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx", + "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx", "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/system/microsoft_windows_dhcp_server/win_system_susp_dhcp_config_failed.yml" ], @@ -14543,8 +14668,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "Internal Research", "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxpackaging_om/win_appxpackaging_om_sups_appx_signature.yml" ], "tags": [ @@ -14667,8 +14792,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/", "https://twitter.com/mattifestation/status/899646620148539397", + "https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/wmi/win_wmi_persistence.yml" ], "tags": [ @@ -14834,8 +14959,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns", "https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/", + "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/dns_client/win_dns_client__mal_cobaltstrike.yml" ], "tags": [ @@ -14868,9 +14993,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", - "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", "https://nxlog.co/documentation/nxlog-user-guide/applocker.html", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker", + "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/applocker/win_applocker_file_was_not_allowed_to_run.yml" ], "tags": [ @@ -14941,11 +15066,11 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs", - "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726", "https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/Recon/PowerView.ps1", "https://github.com/fox-it/BloodHound.py/blob/d65eb614831cd30f26028ccb072f5e77ca287e0b/bloodhound/ad/domain.py#L427", "https://medium.com/falconforce/falconfriday-detecting-active-directory-data-collection-0xff21-c22d1a57494c", + "https://github.com/BloodHoundAD/SharpHound3/blob/7d96b991b1887ff50349ce59c80980bc0d95c86a/SharpHound3/LdapBuilder.cs", + "https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/ldap/win_ldap_recon.yml" ], "tags": [ @@ -14994,10 +15119,10 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "Internal Research", "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/", - "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/", + "Internal Research", + "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_uncommon_package_locations.yml" ], "tags": [ @@ -15020,10 +15145,10 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "Internal Research", "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/", - "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/", + "Internal Research", + "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_package_locations.yml" ], "tags": [ @@ -15046,10 +15171,10 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "Internal Research", "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/", - "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/", + "Internal Research", + "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_domains.yml" ], "tags": [ @@ -15072,10 +15197,10 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "Internal Research", "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/", - "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/", + "Internal Research", + "https://learn.microsoft.com/en-us/windows/win32/appxpkg/troubleshooting", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_susp_appx_package_installation.yml" ], "tags": [ @@ -15122,9 +15247,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/", "https://news.sophos.com/en-us/2021/11/11/bazarloader-call-me-back-attack-abuses-windows-10-apps-mechanism/", "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/", + "https://forensicitguy.github.io/analyzing-magnitude-magniber-appx/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/appxdeployment_server/win_appxdeployment_server_mal_appx_names.yml" ], "tags": [ @@ -15555,8 +15680,8 @@ "logsource.category": "create_stream_hash", "logsource.product": "windows", "refs": [ - "https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md", "https://labs.withsecure.com/publications/detecting-onenote-abuse", + "https://github.com/trustedsec/SysmonCommunityGuide/blob/adcdfee20999f422b974c8d4149bf4c361237db7/chapters/file-stream-creation-hash.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_stream_hash/create_stream_hash_susp_ip_domains.yml" ], "tags": [ @@ -15789,8 +15914,8 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html", "https://www.dfirnotes.net/portproxy_detection/", + "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html", "https://adepts.of0x.cc/netsh-portproxy-code/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml" ], @@ -15826,8 +15951,8 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/", "https://github.com/vxunderground/VXUG-Papers/blob/751edb8d50f95bd7baa730adf2c6c3bb1b034276/The%20Persistence%20Series/Persistence%20via%20Recycle%20Bin/Persistence_via_Recycle_Bin.pdf", + "https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/", "https://persistence-info.github.io/Data/recyclebin.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_persistence_recycle_bin.yml" ], @@ -15861,8 +15986,8 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "https://twitter.com/SBousseaden/status/1183745981189427200", "https://blog.xpnsec.com/exploring-mimikatz-part-1/", + "https://twitter.com/SBousseaden/status/1183745981189427200", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_susp_lsass_dll_load.yml" ], "tags": [ @@ -15931,10 +16056,10 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913", - "https://nvd.nist.gov/vuln/detail/cve-2021-1675", - "https://github.com/gentilkiwi/mimikatz/commit/c21276072b3f2a47a21e215a46962a17d54b3760", "https://nvd.nist.gov/vuln/detail/cve-2021-34527", + "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913", + "https://github.com/gentilkiwi/mimikatz/commit/c21276072b3f2a47a21e215a46962a17d54b3760", + "https://nvd.nist.gov/vuln/detail/cve-2021-1675", "https://www.lexjansen.com/sesug/1993/SESUG93035.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_mimikatz_printernightmare.yml" ], @@ -16004,8 +16129,8 @@ "logsource.product": "windows", "refs": [ "http://az4n6.blogspot.com/2016/02/more-on-trust-records-macros-and.html", - "https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/", "https://twitter.com/inversecos/status/1494174785621819397", + "https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_office_trust_record_modification.yml" ], "tags": [ @@ -16038,8 +16163,8 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "https://twitter.com/pabraeken/status/990717080805789697", "https://lolbas-project.github.io/lolbas/Binaries/Runonce/", + "https://twitter.com/pabraeken/status/990717080805789697", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_runonce_persistence.yml" ], "tags": [ @@ -16311,8 +16436,8 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/", "https://github.com/eset/malware-ioc/tree/master/oceanlotus", + "https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_apt_oceanlotus_registry.yml" ], "tags": [ @@ -16654,8 +16779,8 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/", "https://lolbas-project.github.io/lolbas/Binaries/Atbroker/", + "http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml" ], "tags": [ @@ -16829,10 +16954,10 @@ "logsource.category": "registry_event", "logsource.product": "windows", "refs": [ - "https://github.com/hfiref0x/UACME", "https://tria.ge/211119-gs7rtshcfr/behavioral2 [Lokibot sample from Nov 2021]", - "https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/", "https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass", + "https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/", + "https://github.com/hfiref0x/UACME", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_event/registry_event_shell_open_keys_manipulation.yml" ], "tags": [ @@ -17013,9 +17138,9 @@ "logsource.category": "registry_delete", "logsource.product": "windows", "refs": [ + "https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html", "https://docs.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer", "http://woshub.com/how-to-clear-rdp-connections-history/", - "https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml" ], "tags": [ @@ -17189,11 +17314,11 @@ "logsource.category": "registry_delete", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows/win32/shell/launch", - "https://docs.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand", - "https://github.com/OTRF/detection-hackathon-apt29/issues/7", - "https://docs.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code", "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.C.1_22A46621-7A92-48C1-81BF-B3937EB4FDC3.md", + "https://github.com/OTRF/detection-hackathon-apt29/issues/7", + "https://docs.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand", + "https://docs.microsoft.com/en-us/windows/win32/shell/launch", + "https://docs.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_delete/registry_delete_removal_com_hijacking_registry_key.yml" ], "tags": [ @@ -17226,8 +17351,8 @@ "logsource.category": "registry_add", "logsource.product": "windows", "refs": [ - "https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/", "https://blog.yoroi.company/research/ursnif-long-live-the-steganography/", + "https://blog.trendmicro.com/trendlabs-security-intelligence/phishing-campaign-uses-hijacked-emails-to-deliver-ursnif-by-replying-to-ongoing-threads/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_add/registry_add_malware_ursnif.yml" ], "tags": [ @@ -17293,8 +17418,8 @@ "logsource.category": "registry_add", "logsource.product": "windows", "refs": [ - "https://persistence-info.github.io/Data/diskcleanuphandler.html", "https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/", + "https://persistence-info.github.io/Data/diskcleanuphandler.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_add/registry_add_persistence_disk_cleanup_handler_entry.yml" ], "tags": [ @@ -17352,10 +17477,10 @@ "logsource.product": "windows", "refs": [ "https://www.fortinet.com/blog/threat-research/new-netwire-rat-variant-spread-by-phishing", - "https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/", "https://blogs.blackberry.com/en/2021/09/threat-thursday-netwire-rat-is-coming-down-the-line", - "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/", + "https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/", "https://app.any.run/tasks/41ecdbde-4997-4301-a350-0270448b4c8f/", + "https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_add/registry_add_malware_netwire.yml" ], "tags": [ @@ -17554,9 +17679,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ + "http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/", "https://twitter.com/Hexacorn/status/991447379864932352", "https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml", - "http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml" ], "tags": [ @@ -17689,8 +17814,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/", "https://persistence-info.github.io/Data/htmlhelpauthor.html", + "https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_chm.yml" ], "tags": [ @@ -17736,8 +17861,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/rootm0s/WinPwnage", "https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/", + "https://github.com/rootm0s/WinPwnage", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_appx_debugger.yml" ], "tags": [ @@ -17770,8 +17895,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1674399582162153472", "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/", + "https://twitter.com/0gtweet/status/1674399582162153472", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml" ], "tags": [ @@ -17945,11 +18070,11 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html", - "https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN", - "https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6", "https://devblogs.microsoft.com/scripting/determine-pending-reboot-statuspowershell-style-part-1/", + "https://www.trendmicro.com/en_us/research/21/j/purplefox-adds-new-backdoor-that-uses-websockets.html", + "https://www.trendmicro.com/en_us/research/19/i/purple-fox-fileless-malware-with-rookit-component-delivered-by-rig-exploit-kit-now-abuses-powershell.html", + "https://any.run/report/3ecd4763ffc944fdc67a9027e459cd4f448b1a8d1b36147977afaf86bbf2a261/64b0ba45-e7ce-423b-9a1d-5b4ea59521e6", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_susp_pendingfilerenameoperations.yml" ], "tags": [ @@ -17982,8 +18107,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738", "https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465", + "https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_policies_associations_tamper.yml" ], "tags": [ @@ -18007,9 +18132,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion_nt.yml" ], "tags": [ @@ -18042,13 +18167,13 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html", "https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03", - "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/", - "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/", "http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/", + "https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html", "https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services", "https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html", + "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/", + "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_terminal_server_suspicious.yml" ], "tags": [ @@ -18140,9 +18265,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_session_manager.yml" ], "tags": [ @@ -18230,8 +18355,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.exploit-db.com/exploits/47696", "http://blog.sevagas.com/?Yet-another-sdclt-UAC-bypass", + "https://www.exploit-db.com/exploits/47696", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_comhijack_sdclt.yml" ], "tags": [ @@ -18305,8 +18430,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/", "https://redcanary.com/blog/blackbyte-ransomware/?utm_source=twitter&utm_medium=social", + "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_blackbyte_ransomware.yml" ], "tags": [ @@ -18458,10 +18583,10 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", + "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/", - "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node.yml" ], "tags": [ @@ -18494,8 +18619,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index", "https://github.com/SwiftOnSecurity/sysmon-config/pull/92/files", + "https://renenyffenegger.ch/notes/Windows/registry/tree/HKEY_CURRENT_USER/Keyboard-Layout/Preload/index", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_susp_keyboard_layout_load.yml" ], "tags": [ @@ -18705,8 +18830,8 @@ "logsource.product": "windows", "refs": [ "https://persistence-info.github.io/Data/codesigning.html", - "https://github.com/gtworek/PSBits/tree/master/SIP", "https://specterops.io/assets/resources/SpecterOps_Subverting_Trust_in_Windows.pdf", + "https://github.com/gtworek/PSBits/tree/master/SIP", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_sip_persistence.yml" ], "tags": [ @@ -18741,9 +18866,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_classes.yml" ], "tags": [ @@ -18842,8 +18967,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/last-byte/PersistenceSniper", "https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/", + "https://github.com/last-byte/PersistenceSniper", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dbgmanageddebugger_persistence.yml" ], "tags": [ @@ -18876,8 +19001,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "Internal Research", "https://admx.help/?Category=Office2016&Policy=excel16.Office.Microsoft.Policies.Windows::L_TrustedLoc01", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_trusted_location_uncommon.yml" ], "tags": [ @@ -19033,8 +19158,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp", "https://twitter.com/WhichbufferArda/status/1543900539280293889", + "https://github.com/DebugPrivilege/CPP/blob/c39d365617dbfbcb01fffad200d52b6239b2918c/Windows%20Defender/RestoreDefenderConfig.cpp", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disable_winevt_logging.yml" ], "tags": [ @@ -19176,8 +19301,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "Internal Research", "https://twitter.com/inversecos/status/1494174785621819397", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_trust_record_susp_location.yml" ], "tags": [ @@ -19210,8 +19335,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html", "https://github.com/frack113/atomic-red-team/blob/a9051c38de8a5320b31c7039efcbd3b56cf2d65a/atomics/T1547.001/T1547.001.md#atomic-test-9---systembc-malware-as-a-service-registry", + "https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_powershell_in_run_keys.yml" ], "tags": [ @@ -19314,8 +19439,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://persistence-info.github.io/Data/diskcleanuphandler.html", "https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/", + "https://persistence-info.github.io/Data/diskcleanuphandler.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disk_cleanup_handler_autorun_persistence.yml" ], "tags": [ @@ -19528,10 +19653,10 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://persistence-info.github.io/Data/userinitmprlogonscript.html", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_common.yml" ], "tags": [ @@ -19671,13 +19796,13 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html", "https://twitter.com/SagieSec/status/1469001618863624194?t=HRf0eA0W1YYzkTSHb-Ky1A&s=03", - "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/", - "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/", "http://woshub.com/rds-shadow-how-to-connect-to-a-user-session-in-windows-server-2012-r2/", + "https://blog.menasec.net/2019/02/threat-hunting-rdp-hijacking-via.html", "https://admx.help/HKLM/SOFTWARE/Policies/Microsoft/Windows%20NT/Terminal%20Services", "https://threathunterplaybook.com/hunts/windows/190407-RegModEnableRDPConnections/notebook.html", + "https://bazaar.abuse.ch/sample/6f3aa9362d72e806490a8abce245331030d1ab5ac77e400dd475748236a6cc81/", + "http://etutorials.org/Microsoft+Products/microsoft+windows+server+2003+terminal+services/Chapter+6+Registry/Registry+Keys+for+Terminal+Services/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_terminal_server_tampering.yml" ], "tags": [ @@ -19745,9 +19870,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_office.yml" ], "tags": [ @@ -19781,9 +19906,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_classes.yml" ], "tags": [ @@ -20036,8 +20161,8 @@ "logsource.product": "windows", "refs": [ "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf", - "https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise", "https://unit42.paloaltonetworks.com/operation-ke3chang-resurfaces-with-new-tidepool-malware/", + "https://admx.help/?Category=InternetExplorer&Policy=Microsoft.Policies.InternetExplorer::NoFirstRunCustomise", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_internet_explorer_disable_first_run_customize.yml" ], "tags": [ @@ -20060,8 +20185,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738", "https://www.virustotal.com/gui/file/2bcd5702a7565952c44075ac6fb946c7780526640d1264f692c7664c02c68465", + "https://support.microsoft.com/en-us/topic/information-about-the-attachment-manager-in-microsoft-windows-c48a4dcd-8de5-2af5-ee9b-cd795ae42738", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_policies_attachments_tamper.yml" ], "tags": [ @@ -20117,8 +20242,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/", "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/", + "https://app.any.run/tasks/77b2e328-8f36-46b2-b2e2-8a80398217ab/", "https://learn.microsoft.com/en-us/windows/win32/api/winevt/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_change_winevt_channelaccess.yml" ], @@ -20153,9 +20278,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_winsock2.yml" ], "tags": [ @@ -20188,10 +20313,10 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine", - "https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html", "https://strontic.github.io/xcyclopedia/library/clsid_C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6.html", "https://www.virustotal.com/gui/file/6d3ab9e729bb03ae8ae3fcd824474c5052a165de6cb4c27334969a542c7b261d/detection", + "https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html", + "https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_comhijack_psfactorybuffer.yml" ], "tags": [ @@ -20224,8 +20349,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://github.com/microsoft/winget-cli/blob/02d2f93807c9851d73eaacb4d8811a76b64b7b01/src/AppInstallerCommonCore/Public/winget/AdminSettings.h#L13", + "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_winget_admin_settings_tampering.yml" ], "tags": [ @@ -20373,9 +20498,9 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/JAMESWT_MHT/status/1699042827261391247", - "https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries", "https://twitter.com/M_haggis/status/1699056847154725107", "https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content", + "https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_ie_security_zone_protocol_defaults_downgrade.yml" ], "tags": [ @@ -20529,12 +20654,12 @@ "logsource.product": "windows", "refs": [ "https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.WindowsDefender::SpyNetReporting", - "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", + "https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html", "https://gist.github.com/anadr/7465a9fde63d41341136949f14c21105", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", - "https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html", - "https://www.tenforums.com/tutorials/105533-enable-disable-windows-defender-exploit-protection-settings.html", + "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", "https://www.tenforums.com/tutorials/32236-enable-disable-microsoft-defender-pua-protection-windows-10-a.html", + "https://www.tenforums.com/tutorials/123792-turn-off-tamper-protection-microsoft-defender-antivirus.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_windows_defender_tamper.yml" ], "tags": [ @@ -20567,8 +20692,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70", "https://support.microsoft.com/en-us/topic/outlook-home-page-feature-is-missing-in-folder-properties-d207edb7-aa02-46c5-b608-5d9dbed9bd04?ui=en-us&rs=en-us&ad=us", + "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=70", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_outlook_homepage.yml" ], "tags": [ @@ -20601,8 +20726,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md#atomic-test-6---add-root-certificate-to-currentuser-certificate-store", + "https://posts.specterops.io/code-signing-certificate-cloning-attacks-and-defenses-6f98657fc6ec", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat.yml" ], "tags": [ @@ -20668,8 +20793,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/", "https://github.com/hfiref0x/UACME", + "https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_uac_bypass_sdclt.yml" ], "tags": [ @@ -20755,9 +20880,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/", - "https://twitter.com/inversecos/status/1494174785621819397", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/", + "https://twitter.com/inversecos/status/1494174785621819397", + "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_access_vbom_tamper.yml" ], "tags": [ @@ -20847,9 +20972,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ + "https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf", "https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", - "https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_shim_database_uncommon_location.yml" ], "tags": [ @@ -21048,8 +21173,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone", "https://docs.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-4---add-domain-to-trusted-sites-zone", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_change_security_zones.yml" ], "tags": [ @@ -21082,8 +21207,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://persistence-info.github.io/Data/naturallanguage6.html", "https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/", + "https://persistence-info.github.io/Data/naturallanguage6.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_natural_language.yml" ], "tags": [ @@ -21176,9 +21301,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_wow6432node_currentversion.yml" ], "tags": [ @@ -21211,8 +21336,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek", "https://persistence-info.github.io/Data/mpnotify.html", + "https://www.youtube.com/watch?v=ggY3srD9dYs&ab_channel=GrzegorzTworek", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_mpnotify.yml" ], "tags": [ @@ -21236,9 +21361,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentcontrolset.yml" ], "tags": [ @@ -21362,9 +21487,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_system_scripts.yml" ], "tags": [ @@ -21431,8 +21556,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/deepinstinct/Lsass-Shtinkering", "https://learn.microsoft.com/en-us/windows/win32/wer/collecting-user-mode-dumps", + "https://github.com/deepinstinct/Lsass-Shtinkering", "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_lsass_usermode_dumping.yml" ], @@ -21466,8 +21591,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx", "https://msdn.microsoft.com/de-de/library/windows/desktop/aa363389(v=vs.85).aspx", + "https://technet.microsoft.com/en-us/library/cc726884(v=ws.10).aspx", "https://blog.3or.de/mimilib-dhcp-server-callout-dll-injection.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dhcp_calloutdll.yml" ], @@ -21510,9 +21635,9 @@ "logsource.product": "windows", "refs": [ "https://admx.help/HKCU/software/policies/microsoft/office/16.0/excel/security/protectedview", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", - "https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/", "https://yoroi.company/research/cyber-criminal-espionage-operation-insists-on-italian-manufacturing/", + "https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_disable_protected_view_features.yml" ], "tags": [ @@ -21545,8 +21670,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md", "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/", + "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_special_accounts.yml" ], "tags": [ @@ -21580,8 +21705,8 @@ "logsource.product": "windows", "refs": [ "https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/", - "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-3---registry-key-creation-andor-modification-events-for-sdb", + "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_shim_database.yml" ], "tags": [ @@ -21715,9 +21840,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors", "https://www.sans.org/cyber-security-summit/archives", "https://twitter.com/jamieantisocial/status/1304520651248668673", + "https://www.slideshare.net/JamieWilliams130/started-from-the-bottom-exploiting-data-sources-to-uncover-attck-behaviors", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_enabling_cor_profiler_env_variables.yml" ], "tags": [ @@ -21911,8 +22036,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pillowmint-fin7s-monkey-thief/", + "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_shim_database_susp_application.yml" ], "tags": [ @@ -22012,9 +22137,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/", - "https://twitter.com/inversecos/status/1494174785621819397", "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/zloader-with-a-new-infection-technique/", + "https://twitter.com/inversecos/status/1494174785621819397", + "https://securelist.com/scarcruft-surveilling-north-korean-defectors-and-human-rights-activists/105074/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_office_vba_warnings_tamper.yml" ], "tags": [ @@ -22071,8 +22196,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md#atomic-test-1---bypass-uac-using-event-viewer-cmd", + "https://enigma0x3.net/2016/08/15/fileless-uac-bypass-using-eventvwr-exe-and-registry-hijacking/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_bypass_uac_using_eventviewer.yml" ], "tags": [ @@ -22175,8 +22300,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/OTRF/detection-hackathon-apt29/issues/1", "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/1.A.1_DFD6A782-9BDB-4550-AB6B-525E825B095E.md", + "https://github.com/OTRF/detection-hackathon-apt29/issues/1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_new_application_appcompat.yml" ], "tags": [ @@ -22243,9 +22368,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://twitter.com/VakninHai/status/1517027824984547329", - "https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files", "https://twitter.com/pabraeken/status/998627081360695297", + "https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files", + "https://twitter.com/VakninHai/status/1517027824984547329", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_scr_file_executed_by_rundll32.yml" ], "tags": [ @@ -22345,8 +22470,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/", "https://persistence-info.github.io/Data/autodialdll.html", + "https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_autodial_dll.yml" ], "tags": [ @@ -22438,10 +22563,10 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", + "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://oddvar.moe/2018/03/21/persistence-using-runonceex-hidden-from-autoruns-exe/", - "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_currentversion.yml" ], "tags": [ @@ -22507,9 +22632,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd", "https://unit42.paloaltonetworks.com/ransomware-families/", "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name=TrojanSpy%3aMSIL%2fHakey.A", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-1---modify-registry-of-current-user-profile---cmd", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_hidden_extention.yml" ], "tags": [ @@ -22617,8 +22742,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5", "https://learn.microsoft.com/en-us/visualstudio/deployment/how-to-configure-the-clickonce-trust-prompt-behavior", + "https://posts.specterops.io/less-smartscreen-more-caffeine-ab-using-clickonce-for-trusted-code-execution-1446ea8051c5", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_clickonce_trust_prompt.yml" ], "tags": [ @@ -22684,9 +22809,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/", - "https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope", "https://github.com/S3cur3Th1sSh1t/OffensiveVBA/blob/28cc6a2802d8176195ac19b3c8e9a749009a82a3/src/AMSIbypasses.vba", + "https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_MacroRuntimeScanScope", + "https://www.microsoft.com/en-us/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disable_macroruntimescanscope.yml" ], "tags": [ @@ -22709,10 +22834,10 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html", - "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode", - "https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS", "https://github.com/elastic/detection-rules/issues/1371", + "https://www.tenforums.com/tutorials/151318-how-enable-disable-dns-over-https-doh-microsoft-edge.html", + "https://admx.help/HKLM/Software/Policies/Mozilla/Firefox/DNSOverHTTPS", + "https://chromeenterprise.google/policies/?policy=DnsOverHttpsMode", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dns_over_https_enabled.yml" ], "tags": [ @@ -22753,8 +22878,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html", "https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/", + "https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_reflectdebugger.yml" ], "tags": [ @@ -22820,10 +22945,10 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/", "https://github.com/redcanaryco/atomic-red-team/blob/f296668303c29d3f4c07e42bdd2b28d8dd6625f9/atomics/T1112/T1112.md", - "https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks", "https://twitter.com/nas_bench/status/1626648985824788480", + "https://admx.help/?Category=Windows_7_2008R2&Policy=Microsoft.Policies.InternetCommunicationManagement::EventViewer_DisableLinks", + "https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_event_viewer_events_asp.yml" ], "tags": [ @@ -22890,8 +23015,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf", "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", + "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf", "https://twitter.com/MichalKoczwara/status/1553634816016498688", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disable_autologger_sessions.yml" ], @@ -22915,17 +23040,17 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38", - "http://managed670.rssing.com/chan-5590147/all_p1.html", "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf", + "http://managed670.rssing.com/chan-5590147/all_p1.html", + "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38", "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables", "https://bunnyinside.com/?term=f71e8cb9c76a", - "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39", - "https://twitter.com/_xpn_/status/1268712093928378368", - "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_", - "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr", "https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code", + "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr", + "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39", + "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_", "https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/", + "https://twitter.com/_xpn_/status/1268712093928378368", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_dot_net_etw_tamper.yml" ], "tags": [ @@ -23000,9 +23125,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", "https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md", + "https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_asep_reg_keys_modification_internet_explorer.yml" ], "tags": [ @@ -23102,9 +23227,9 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md", "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html", "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_disable_function_user.yml" ], "tags": [ @@ -23137,8 +23262,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-comreg-bypass", "https://enigma0x3.net/2017/07/19/bypassing-amsi-via-com-server-hijacking/", + "https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-comreg-bypass", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_amsi_com_hijack.yml" ], "tags": [ @@ -23171,10 +23296,10 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1468548924600459267", - "https://github.com/gtworek/PSBits/tree/master/IFilter", "https://github.com/gtworek/PSBits/blob/8d767892f3b17eefa4d0668f5d2df78e844f01d8/IFilter/Dll.cpp#L281-L308", + "https://twitter.com/0gtweet/status/1468548924600459267", "https://persistence-info.github.io/Data/ifilters.html", + "https://github.com/gtworek/PSBits/tree/master/IFilter", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_persistence_ifilter.yml" ], "tags": [ @@ -23255,8 +23380,8 @@ "logsource.category": "registry_set", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time", "https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1543.003/T1543.003.md#atomic-test-4---tinyturla-backdoor-service-w64time", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/registry/registry_set/registry_set_servicedll_hijack.yml" ], "tags": [ @@ -23360,9 +23485,9 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Wmic/", "https://securitydatasets.com/notebooks/atomic/windows/defense_evasion/SDWIN-201017061100.html", "https://twitter.com/dez_/status/986614411711442944", + "https://lolbas-project.github.io/lolbas/Binaries/Wmic/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_wmic_remote_xsl_scripting_dlls.yml" ], "tags": [ @@ -23565,8 +23690,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992", "https://decoded.avast.io/martinchlumecky/png-steganography/", + "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_svchost_dlls.yml" ], "tags": [ @@ -23609,9 +23734,9 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html", - "https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/", "https://twitter.com/HunterPlaybook/status/1301207718355759107", + "https://www.mdsec.co.uk/2020/09/i-like-to-move-it-windows-lateral-movement-part-1-wmi-event-subscription/", + "https://threathunterplaybook.com/hunts/windows/200902-RemoteWMIActiveScriptEventConsumers/notebook.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_scrcons_wmi_scripteventconsumer.yml" ], "tags": [ @@ -23690,10 +23815,10 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://github.com/bohops/WSMan-WinRM", - "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/", "https://twitter.com/chadtilbury/status/1275851297770610688", "https://docs.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture", + "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/", + "https://github.com/bohops/WSMan-WinRM", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_wsman_provider_image_load.yml" ], "tags": [ @@ -24397,12 +24522,12 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/", - "https://decoded.avast.io/martinchlumecky/png-steganography/", - "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/", - "https://github.com/Wh04m1001/SysmonEoP", - "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html", "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992", + "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/", + "https://github.com/Wh04m1001/SysmonEoP", + "https://decoded.avast.io/martinchlumecky/png-steganography/", + "http://remoteawesomethoughts.blogspot.com/2019/05/windows-10-task-schedulerservice.html", + "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_non_existent_dlls.yml" ], "tags": [ @@ -24488,8 +24613,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "Internal Research", "https://www.paloaltonetworks.com/blog/security-operations/stopping-powershell-without-powershell/", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_amsi_suspicious_process.yml" ], "tags": [ @@ -24554,8 +24679,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp", "https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/", + "http://www.windowexe.com/bbs/board.php?q=jsschhlp-exe-c-program-files-common-files-justsystem-jsschhlp-jsschhlp", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_jsschhlp.yml" ], "tags": [ @@ -24750,10 +24875,10 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/", "https://hijacklibs.net/", - "https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/", "https://github.com/XForceIR/SideLoadHunter/blob/cc7ef2e5d8908279b0c4cee4e8b6f85f7b8eed52/SideLoads/README.md", + "https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading/", + "https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_from_non_system_location.yml" ], "tags": [ @@ -24796,8 +24921,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html", "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/", + "https://www.trendmicro.com/en_us/research/23/f/behind-the-scenes-unveiling-the-hidden-workings-of-earth-preta.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_abused_dlls_susp_paths.yml" ], "tags": [ @@ -24830,8 +24955,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add", "https://twitter.com/am0nsec/status/1412232114980982787", + "https://www.virustotal.com/gui/file/ba88ca45589fae0139a40ca27738a8fc2dfbe1be5a64a9558f4e0f52b35c5add", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_vss_ps_susp_load.yml" ], "tags": [ @@ -25027,8 +25152,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://github.com/p3nt4/PowerShdll", "https://adsecurity.org/?p=2921", + "https://github.com/p3nt4/PowerShdll", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml" ], "tags": [ @@ -25182,8 +25307,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://www.mandiant.com/resources/blog/lnk-between-browsers", "https://wazuh.com/blog/detecting-xll-files-used-for-dropping-fin7-jssloader-with-wazuh/", + "https://www.mandiant.com/resources/blog/lnk-between-browsers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_office_excel_xll_susp_load.yml" ], "tags": [ @@ -25475,10 +25600,10 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://thewover.github.io/Introducing-Donut/", "https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html", "https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008", "https://github.com/tyranid/DotNetToJScript", + "https://thewover.github.io/Introducing-Donut/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_susp_script_dotnet_clr_dll_load.yml" ], "tags": [ @@ -25633,8 +25758,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://twitter.com/WhichbufferArda/status/1658829954182774784", "https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/", + "https://twitter.com/WhichbufferArda/status/1658829954182774784", "https://securelist.com/apt-luminousmoth/103332/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_wwlib.yml" ], @@ -25711,9 +25836,9 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://twitter.com/mattifestation/status/1196390321783025666", "https://twitter.com/oulusoyum/status/1191329746069655553", "https://lolbas-project.github.io/lolbas/Binaries/Tttracer/", + "https://twitter.com/mattifestation/status/1196390321783025666", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_tttracer_module_load.yml" ], "tags": [ @@ -25842,9 +25967,9 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://twitter.com/StopMalvertisin/status/1648604148848549888", - "https://twitter.com/t3ft3lb/status/1656194831830401024", "https://www.roboform.com/", + "https://twitter.com/t3ft3lb/status/1656194831830401024", + "https://twitter.com/StopMalvertisin/status/1648604148848549888", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_robform.yml" ], "tags": [ @@ -26269,8 +26394,8 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html", "https://mobile.twitter.com/0gtweet/status/1564131230941122561", + "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_side_load_shell_chrome_api.yml" ], "tags": [ @@ -26730,10 +26855,10 @@ "logsource.category": "image_load", "logsource.product": "windows", "refs": [ - "https://github.com/S12cybersecurity/RDPCredentialStealer", - "https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password", "https://docs.microsoft.com/en-us/windows/win32/api/wincred/nf-wincred-creduipromptforcredentialsa", + "https://securitydatasets.com/notebooks/atomic/windows/credential_access/SDWIN-201020013208.html", + "https://github.com/S12cybersecurity/RDPCredentialStealer", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.002/T1056.002.md#atomic-test-2---powershell---prompt-user-for-password", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/image_load/image_load_dll_credui_uncommon_process_load.yml" ], "tags": [ @@ -26842,8 +26967,8 @@ "logsource.product": "windows", "refs": [ "https://github.com/Neo23x0/signature-base/blob/615bf1f6bac3c1bdc417025c40c073e6c2771a76/yara/gen_susp_lnk_files.yar#L19", - "https://github.com/RiccardoAncarani/LiquidSnake", "https://in.security/an-intro-into-abusing-and-identifying-wmi-event-subscriptions-for-persistence/", + "https://github.com/RiccardoAncarani/LiquidSnake", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/wmi_event/sysmon_wmi_susp_scripting.yml" ], "tags": [ @@ -26911,9 +27036,9 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/bohops/WSMan-WinRM", - "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/", "https://twitter.com/chadtilbury/status/1275851297770610688", + "https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/", + "https://github.com/bohops/WSMan-WinRM", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml" ], "tags": [ @@ -27133,8 +27258,8 @@ "logsource.category": "ps_classic_start", "logsource.product": "windows", "refs": [ - "https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md", + "https://www.fortinet.com/blog/threat-research/stomping-shadow-copies-a-second-look-into-deletion-methods", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_classic/posh_pc_delete_volume_shadow_copies.yml" ], "tags": [ @@ -27332,8 +27457,8 @@ "logsource.category": "No established category", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", + "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml" ], "tags": [ @@ -27511,9 +27636,9 @@ "logsource.category": "ps_module", "logsource.product": "windows", "refs": [ - "https://github.com/samratashok/ADModule", - "https://twitter.com/cyb3rops/status/1617108657166061568?s=20", "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges", + "https://twitter.com/cyb3rops/status/1617108657166061568?s=20", + "https://github.com/samratashok/ADModule", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_active_directory_module_dll_import.yml" ], "tags": [ @@ -27572,8 +27697,8 @@ "logsource.category": "ps_module", "logsource.product": "windows", "refs": [ - "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.A.3_09F29912-8E93-461E-9E89-3F06F6763383.md", "https://github.com/OTRF/detection-hackathon-apt29/issues/8", + "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.A.3_09F29912-8E93-461E-9E89-3F06F6763383.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml" ], "tags": [ @@ -27756,8 +27881,8 @@ "logsource.category": "ps_module", "logsource.product": "windows", "refs": [ - "https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md", "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/", + "https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml" ], "tags": [ @@ -27865,24 +27990,24 @@ "logsource.category": "ps_module", "logsource.product": "windows", "refs": [ - "https://github.com/samratashok/nishang", - "https://github.com/HarmJ0y/DAMP", - "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", - "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html", - "https://github.com/adrecon/AzureADRecon", + "https://github.com/adrecon/ADRecon", "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1", "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", - "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", - "https://github.com/calebstewart/CVE-2021-1675", - "https://github.com/adrecon/ADRecon", - "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1", - "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", - "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1", - "https://github.com/besimorhino/powercat", - "https://github.com/Kevin-Robertson/Powermad", - "https://adsecurity.org/?p=2921", + "https://github.com/samratashok/nishang", + "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html", + "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", "https://github.com/DarkCoderSc/PowerRunAsSystem/", + "https://github.com/adrecon/AzureADRecon", + "https://github.com/besimorhino/powercat", + "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", + "https://github.com/HarmJ0y/DAMP", + "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1", + "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", + "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", + "https://github.com/calebstewart/CVE-2021-1675", + "https://adsecurity.org/?p=2921", + "https://github.com/Kevin-Robertson/Powermad", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml" ], "tags": [ @@ -28247,22 +28372,22 @@ "logsource.category": "ps_module", "logsource.product": "windows", "refs": [ - "https://github.com/nettitude/Invoke-PowerThIEf", - "https://github.com/HarmJ0y/DAMP", - "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", - "https://github.com/samratashok/nishang", - "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", - "https://github.com/besimorhino/powercat", - "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", - "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", + "https://github.com/S3cur3Th1sSh1t/WinPwn", + "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1", + "https://github.com/NetSPI/PowerUpSQL", "https://github.com/PowerShellMafia/PowerSploit", "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1", - "https://github.com/AlsidOfficial/WSUSpendu/", - "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", + "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", + "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", + "https://github.com/samratashok/nishang", "https://github.com/DarkCoderSc/PowerRunAsSystem/", - "https://github.com/NetSPI/PowerUpSQL", - "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1", - "https://github.com/S3cur3Th1sSh1t/WinPwn", + "https://github.com/besimorhino/powercat", + "https://github.com/nettitude/Invoke-PowerThIEf", + "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", + "https://github.com/HarmJ0y/DAMP", + "https://github.com/AlsidOfficial/WSUSpendu/", + "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", + "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", "https://github.com/CsEnox/EventViewer-UACBypass", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml" ], @@ -28477,8 +28602,8 @@ "logsource.category": "ps_module", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1", + "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml" ], "tags": [ @@ -28511,8 +28636,8 @@ "logsource.category": "ps_module", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", + "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml" ], "tags": [ @@ -28686,8 +28811,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content", "https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell", + "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_add_windows_capability.yml" ], "tags": [ @@ -28811,8 +28936,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", + "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml" ], "tags": [ @@ -29053,8 +29178,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://bidouillesecurity.com/disable-windows-defender-in-powershell/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_tamper_windows_defender_set_mp.yml" ], @@ -29121,9 +29246,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt", "https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html", + "https://docs.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml" ], "tags": [ @@ -29275,9 +29400,9 @@ "logsource.product": "windows", "refs": [ "https://adsecurity.org/?p=2277", - "https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon", "https://powersploit.readthedocs.io/en/stable/Recon/README", "https://thedfirreport.com/2020/10/08/ryuks-return", + "https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml" ], "tags": [ @@ -29420,9 +29545,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", - "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf", "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", + "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf", + "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml" ], "tags": [ @@ -29658,10 +29783,10 @@ "logsource.product": "windows", "refs": [ "http://woshub.com/manage-windows-firewall-powershell/", - "http://powershellhelp.space/commands/set-netfirewallrule-psv5.php", - "https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell", "https://docs.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2019-ps", + "https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell", "https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html", + "http://powershellhelp.space/commands/set-netfirewallrule-psv5.php", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_windows_firewall_profile_disabled.yml" ], "tags": [ @@ -29852,9 +29977,9 @@ "logsource.product": "windows", "refs": [ "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html", - "https://youtu.be/5mqid-7zp8k?t=2481", "https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1", "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/", + "https://youtu.be/5mqid-7zp8k?t=2481", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml" ], "tags": [ @@ -29943,8 +30068,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://www.fortypoundhead.com/showcontent.asp?artid=24022", "https://labs.withsecure.com/publications/fin7-target-veeam-servers", + "https://www.fortypoundhead.com/showcontent.asp?artid=24022", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml" ], "tags": [ @@ -30010,8 +30135,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1573/T1573.md#atomic-test-1---openssl-c2", + "https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_ssl_keyword.yml" ], "tags": [ @@ -30628,8 +30753,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Remove-Item?view=powershell-5.1&viewFallbackFrom=powershell-7", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.004/T1070.004.md", + "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Remove-Item?view=powershell-5.1&viewFallbackFrom=powershell-7", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_remove_item_path.yml" ], "tags": [ @@ -30662,8 +30787,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://twitter.com/JohnLaTwC/status/850381440629981184", "https://t.co/ezOTGy1a1G", + "https://twitter.com/JohnLaTwC/status/850381440629981184", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml" ], "tags": [ @@ -30697,8 +30822,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.2", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-2---invoke-command", + "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.2", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml" ], "tags": [ @@ -30930,9 +31055,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/samratashok/ADModule", - "https://twitter.com/cyb3rops/status/1617108657166061568?s=20", "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges", + "https://twitter.com/cyb3rops/status/1617108657166061568?s=20", + "https://github.com/samratashok/ADModule", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_active_directory_module_dll_import.yml" ], "tags": [ @@ -30957,8 +31082,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1", "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319", + "https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml" ], "tags": [ @@ -30992,8 +31117,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md", "https://docs.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_gpo.yml" ], "tags": [ @@ -31026,8 +31151,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md", "https://docs.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps", + "https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_disable_windows_optional_feature.yml" ], "tags": [ @@ -31188,8 +31313,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell", + "https://docs.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_test_netconnection.yml" ], "tags": [ @@ -31384,8 +31509,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://o365blog.com/aadinternals/", "https://github.com/Gerenios/AADInternals", + "https://o365blog.com/aadinternals/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_aadinternals_cmdlets_execution.yml" ], "tags": [ @@ -31496,8 +31621,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell", "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive.yml" ], "tags": [ @@ -31606,8 +31731,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md#atomic-test-11---get-aduser-enumeration-using-useraccountcontrol-flags-as-rep-roasting", + "https://shellgeek.com/useraccountcontrol-flags-to-manipulate-properties/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml" ], "tags": [ @@ -31775,8 +31900,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness", "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.2", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml" ], "tags": [ @@ -31843,8 +31968,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/", + "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_veeam_credential_dumping_script.yml" ], "tags": [ @@ -31924,9 +32049,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md", "https://twitter.com/oroneequalsone/status/1568432028361830402", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md", + "https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_clear_eventlog.yml" ], "tags": [ @@ -32058,9 +32183,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ + "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/", "https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py", "https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1", - "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_wmi_unquoted_service_search.yml" ], "tags": [ @@ -32093,9 +32218,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ + "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a", "https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html", "https://docs.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate", - "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_export_certificate.yml" ], "tags": [ @@ -32161,8 +32286,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA", "https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/", + "https://twitter.com/cyb3rops/status/1588574518057979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml" ], "tags": [ @@ -32196,8 +32321,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso", + "https://docs.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_run_from_mount_diskimage.yml" ], "tags": [ @@ -32297,8 +32422,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", + "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_user_discovery_get_aduser.yml" ], "tags": [ @@ -32501,9 +32626,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md", "https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md", + "https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml" ], "tags": [ @@ -32544,8 +32669,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md", "https://github.com/harleyQu1nn/AggressorScripts", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml" ], "tags": [ @@ -32653,8 +32778,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image", + "https://docs.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_mount_diskimage.yml" ], "tags": [ @@ -32687,10 +32812,10 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ + "https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1", + "https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462", "https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7", "https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1", - "https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462", - "https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml" ], "tags": [ @@ -32757,8 +32882,8 @@ "logsource.product": "windows", "refs": [ "https://learn.microsoft.com/en-us/windows/wsl/install-on-server", - "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system", "https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps", + "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_enable_susp_windows_optional_feature.yml" ], "tags": [ @@ -32848,8 +32973,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md", + "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_start_process.yml" ], "tags": [ @@ -33090,10 +33215,10 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0", "https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content", - "https://twitter.com/ScumBots/status/1610626724257046529", + "https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0", "https://www.virustotal.com/gui/file/d4486b63512755316625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content", + "https://twitter.com/ScumBots/status/1610626724257046529", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_keylogger_activity.yml" ], "tags": [ @@ -33127,8 +33252,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process", "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_get_process.yml" ], "tags": [ @@ -33302,24 +33427,24 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/samratashok/nishang", - "https://github.com/HarmJ0y/DAMP", - "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", - "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html", - "https://github.com/adrecon/AzureADRecon", + "https://github.com/adrecon/ADRecon", "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1", "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", - "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", - "https://github.com/calebstewart/CVE-2021-1675", - "https://github.com/adrecon/ADRecon", - "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1", - "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", - "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1", - "https://github.com/besimorhino/powercat", - "https://github.com/Kevin-Robertson/Powermad", - "https://adsecurity.org/?p=2921", + "https://github.com/samratashok/nishang", + "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html", + "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", "https://github.com/DarkCoderSc/PowerRunAsSystem/", + "https://github.com/adrecon/AzureADRecon", + "https://github.com/besimorhino/powercat", + "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", + "https://github.com/HarmJ0y/DAMP", + "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1", + "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", + "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", + "https://github.com/calebstewart/CVE-2021-1675", + "https://adsecurity.org/?p=2921", + "https://github.com/Kevin-Robertson/Powermad", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml" ], "tags": [ @@ -33451,9 +33576,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/", "https://www.shellhacks.com/clear-history-powershell/", "https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics", + "https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml" ], "tags": [ @@ -33494,9 +33619,9 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://github.com/GhostPack/Rubeus", "https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus", + "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_hktl_rubeus.yml" ], "tags": [ @@ -33654,8 +33779,8 @@ "logsource.product": "windows", "refs": [ "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42", - "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115", "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41", + "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_x509enrollment.yml" ], "tags": [ @@ -33930,8 +34055,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md", "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Persistence.psm1#L545", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_wmi_persistence.yml" ], "tags": [ @@ -34064,8 +34189,8 @@ "logsource.category": "ps_script", "logsource.product": "windows", "refs": [ - "https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell", + "https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_susp_win32_shadowcopy_deletion.yml" ], "tags": [ @@ -34272,8 +34397,8 @@ "logsource.product": "windows", "refs": [ "https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html", - "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.2", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md", + "https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.2", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell/powershell_script/posh_ps_script_with_upload_capabilities.yml" ], "tags": [ @@ -34505,9 +34630,9 @@ "logsource.category": "create_remote_thread", "logsource.product": "windows", "refs": [ - "https://github.com/GhostPack/KeeThief", "https://github.com/denandz/KeeFarce", "https://www.cisa.gov/uscert/ncas/alerts/aa20-259a", + "https://github.com/GhostPack/KeeThief", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/create_remote_thread/create_remote_thread_win_keepass.yml" ], "tags": [ @@ -34942,8 +35067,8 @@ "logsource.category": "driver_load", "logsource.product": "windows", "refs": [ - "https://systeminformer.sourceforge.io/", "https://github.com/winsiderss/systeminformer", + "https://systeminformer.sourceforge.io/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/driver_load/driver_load_win_pua_system_informer.yml" ], "tags": [ @@ -35085,8 +35210,8 @@ "logsource.category": "driver_load", "logsource.product": "windows", "refs": [ - "https://rastamouse.me/ntlm-relaying-via-cobalt-strike/", "https://reqrypt.org/windivert-doc.html", + "https://rastamouse.me/ntlm-relaying-via-cobalt-strike/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/driver_load/driver_load_win_windivert.yml" ], "tags": [ @@ -35419,8 +35544,8 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python", "https://pypi.org/project/scapy/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-4---port-scan-using-python", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_python.yml" ], "tags": [ @@ -35453,8 +35578,8 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf", "https://blog.cobaltstrike.com/2013/08/08/why-is-notepad-exe-connecting-to-the-internet/", + "https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_notepad_network_connection.yml" ], "tags": [ @@ -35548,8 +35673,8 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://content.fireeye.com/apt-41/rpt-apt41", "https://securelist.com/the-tetrade-brazilian-banking-malware/97779/", + "https://content.fireeye.com/apt-41/rpt-apt41", "https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_dead_drop_resolvers.yml" ], @@ -35990,11 +36115,11 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", + "https://twitter.com/M_haggis/status/900741347035889665", "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/exfil/Invoke-ExfilDataToGitHub.ps1", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", "https://twitter.com/M_haggis/status/1032799638213066752", "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a", - "https://twitter.com/M_haggis/status/900741347035889665", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_binary_susp_com.yml" ], "tags": [ @@ -36027,8 +36152,8 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent", "https://twitter.com/hakluke/status/1587733971814977537/photo/1", + "https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_ngrok_tunnel.yml" ], "tags": [ @@ -36254,10 +36379,10 @@ "logsource.product": "windows", "refs": [ "https://github.com/looCiprian/GC2-sheet", - "https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/", - "https://youtu.be/n2dFlSaBBKo", "https://www.bleepingcomputer.com/news/security/hackers-abuse-google-command-and-control-red-team-tool-in-attacks/", + "https://www.tanium.com/blog/apt41-deploys-google-gc2-for-attacks-cyber-threat-intelligence-roundup/", "https://services.google.com/fh/files/blogs/gcat_threathorizons_full_apr2023.pdf", + "https://youtu.be/n2dFlSaBBKo", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_google_api_non_browser_access.yml" ], "tags": [ @@ -36508,9 +36633,9 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ + "https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al", "https://twitter.com/kleiton0x7e/status/1600567316810551296", "https://github.com/kleiton0x00/RedditC2", - "https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_reddit_api_non_browser_access.yml" ], "tags": [ @@ -36543,8 +36668,8 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://medium.com/@huskyhacks.mk/we-put-a-c2-in-your-notetaking-app-offensivenotion-3e933bace332", "https://github.com/mttaggart/OffensiveNotion", + "https://medium.com/@huskyhacks.mk/we-put-a-c2-in-your-notetaking-app-offensivenotion-3e933bace332", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_notion_api_susp_communication.yml" ], "tags": [ @@ -36687,8 +36812,8 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/", "https://twitter.com/forensicitguy/status/1513538712986079238", + "https://news.sophos.com/en-us/2019/07/18/a-new-equation-editor-exploit-goes-commercial-as-maldoc-attacks-using-it-spike/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_eqnedt.yml" ], "tags": [ @@ -36721,10 +36846,10 @@ "logsource.category": "network_connection", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/", "https://github.com/rsp/scripts/blob/c8bb272d68164a9836e4f273d8f924927f39b8c6/externalip-benchmark.md", - "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a", "https://www.trendmicro.com/en_us/research/23/e/managed-xdr-investigation-of-ducktail-in-trend-micro-vision-one.html", + "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/", + "https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-302a", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/network_connection/net_connection_win_susp_external_ip_lookup.yml" ], "tags": [ @@ -36885,12 +37010,12 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ + "https://github.com/CCob/MirrorDump", + "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/", + "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf", + "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml", "https://github.com/helpsystems/nanodump", "https://www.google.com/search?q=procdump+lsass", - "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml", - "https://github.com/CCob/MirrorDump", - "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf", - "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_lsass_default_dump_file_names.yml" ], "tags": [ @@ -37025,9 +37150,9 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/cube0x0/status/1418920190759378944", - "https://github.com/GossiTheDog/HiveNightmare", - "https://github.com/WiredPulse/Invoke-HiveNightmare", "https://github.com/FireFart/hivenightmare/", + "https://github.com/WiredPulse/Invoke-HiveNightmare", + "https://github.com/GossiTheDog/HiveNightmare", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_hktl_hivenightmare_file_exports.yml" ], "tags": [ @@ -37061,8 +37186,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "Internal Research", "https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_powershell_module_creation.yml" ], "tags": [ @@ -37138,10 +37263,10 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/luc4m/status/1073181154126254080", + "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations", "https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles", "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/", "https://twitter.com/malwrhunterteam/status/1235135745611960321", - "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_lnk_double_extension.yml" ], "tags": [ @@ -37344,8 +37469,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/", "https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/", + "https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_onenote_files_in_susp_locations.yml" ], "tags": [ @@ -37370,10 +37495,10 @@ "logsource.product": "windows", "refs": [ "https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/", - "https://labs.withsecure.com/publications/detecting-onenote-abuse", - "https://twitter.com/MaD_c4t/status/1623414582382567424", "https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/", + "https://labs.withsecure.com/publications/detecting-onenote-abuse", "https://www.trustedsec.com/blog/new-attacks-old-tricks-how-onenote-malware-is-evolving/", + "https://twitter.com/MaD_c4t/status/1623414582382567424", "https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_onenote_susp_dropped_files.yml" ], @@ -37398,9 +37523,9 @@ "logsource.product": "windows", "refs": [ "https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1", - "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/", "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", "https://pentestlab.blog/tag/ntds-dit/", + "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_ntds_dit_uncommon_parent_process.yml" ], "tags": [ @@ -37512,10 +37637,10 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/luc4m/status/1073181154126254080", + "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations", "https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles", "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/", "https://twitter.com/malwrhunterteam/status/1235135745611960321", - "https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_double_extension.yml" ], "tags": [ @@ -37581,9 +37706,9 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/Yaxser/Backstab", "https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/", "https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks", + "https://github.com/Yaxser/Backstab", "https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_sysinternals_procexp_driver_susp_creation.yml" ], @@ -37792,8 +37917,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "Internal Research", "https://github.com/redcanaryco/atomic-red-team/blob/4ae9580a1a8772db87a1b6cdb0d03e5af231e966/atomics/T1137.006/T1137.006.md", + "Internal Research", "https://labs.withsecure.com/publications/add-in-opportunities-for-office-persistence", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_addin_persistence.yml" ], @@ -37894,9 +38019,9 @@ "logsource.product": "windows", "refs": [ "https://app.any.run/tasks/d6fe6624-6ef8-485d-aa75-3d1bdda2a08c/", - "https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions", - "http://addbalance.com/word/startup.htm", "https://answers.microsoft.com/en-us/msoffice/forum/all/document-in-word-startup-folder-doesnt-open-when/44ab0932-2917-4150-8cdc-2f2cf39e86f3", + "http://addbalance.com/word/startup.htm", + "https://en.wikipedia.org/wiki/List_of_Microsoft_Office_filename_extensions", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_uncommon_file_startup.yml" ], "tags": [ @@ -38009,8 +38134,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish", "http://www.irongeek.com/homoglyph-attack-generator.php", + "https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_homoglyph_filename.yml" ], "tags": [ @@ -38100,9 +38225,9 @@ "logsource.product": "windows", "refs": [ "https://www.slipstick.com/developer/custom-form/clean-outlooks-forms-cache/", + "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76", "https://learn.microsoft.com/en-us/office/vba/outlook/concepts/outlook-forms/create-an-outlook-form", "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=79", - "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=76", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_outlook_newform.yml" ], "tags": [ @@ -38170,8 +38295,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://persistence-info.github.io/Data/wpbbin.html", "https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c", + "https://persistence-info.github.io/Data/wpbbin.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_wpbbin_persistence.yml" ], "tags": [ @@ -38481,6 +38606,43 @@ "uuid": "a6976974-ea6f-4e97-818e-ea08625c52cb", "value": "Potential RipZip Attack on Startup Folder" }, + { + "description": "Detects the creation of hidden file/folder with the \"::$index_allocation\" stream. Which can be used as a technique to prevent access to folder and files from tooling such as \"explorer.exe\" and \"powershell.exe\"\n", + "meta": { + "author": "Scoubi (@ScoubiMtl)", + "creation_date": "2023/10/09", + "falsepositive": [ + "Unlikely" + ], + "filename": "file_event_win_susp_hidden_dir_index_allocation.yml", + "level": "medium", + "logsource.category": "file_event", + "logsource.product": "windows", + "refs": [ + "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3", + "https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/", + "https://twitter.com/pfiatde/status/1681977680688738305", + "https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation", + "https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_hidden_dir_index_allocation.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1564.004" + ] + }, + "related": [ + { + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "a8f866e1-bdd4-425e-a27a-37619238d9c7", + "value": "Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream" + }, { "description": "Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.", "meta": { @@ -38494,10 +38656,10 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer", - "https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/", "https://labs.f-secure.com/blog/prelude-to-ransomware-systembc", + "https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer", "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", + "https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/", "https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_advanced_ip_scanner.yml" ], @@ -38565,26 +38727,26 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/HarmJ0y/DAMP", - "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", - "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", - "https://github.com/AlsidOfficial/WSUSpendu/", - "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", - "https://github.com/besimorhino/powercat", - "https://github.com/CsEnox/EventViewer-UACBypass", - "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1", - "https://github.com/DarkCoderSc/PowerRunAsSystem/", - "https://github.com/adrecon/AzureADRecon", - "https://github.com/adrecon/ADRecon", - "https://github.com/Kevin-Robertson/Powermad", - "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", - "https://github.com/PowerShellMafia/PowerSploit", - "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1", - "https://github.com/NetSPI/PowerUpSQL", "https://github.com/S3cur3Th1sSh1t/WinPwn", + "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", + "https://github.com/besimorhino/powercat", + "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", + "https://github.com/AlsidOfficial/WSUSpendu/", + "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", + "https://github.com/adrecon/ADRecon", + "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", + "https://github.com/adrecon/AzureADRecon", "https://github.com/nettitude/Invoke-PowerThIEf", "https://github.com/samratashok/nishang", - "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", + "https://github.com/DarkCoderSc/PowerRunAsSystem/", + "https://github.com/HarmJ0y/DAMP", + "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1", + "https://github.com/NetSPI/PowerUpSQL", + "https://github.com/PowerShellMafia/PowerSploit", + "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1", + "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", + "https://github.com/Kevin-Robertson/Powermad", + "https://github.com/CsEnox/EventViewer-UACBypass", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml" ], "tags": [ @@ -38617,9 +38779,9 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html", - "https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/", "https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html", + "https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/", + "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_exchange_webshell_drop_suspicious.yml" ], "tags": [ @@ -38760,8 +38922,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "Internal Research", "https://labs.withsecure.com/publications/fin7-target-veeam-servers", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_perflogs_susp_files.yml" ], "tags": [ @@ -39029,8 +39191,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies", "https://learn.microsoft.com/en-us/office/troubleshoot/excel/use-startup-folders", + "https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanese-companies", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_startup_persistence.yml" ], "tags": [ @@ -39063,8 +39225,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/", + "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_rdp_file_susp_creation.yml" ], "tags": [ @@ -39285,8 +39447,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd", "https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/", + "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_msdt_susp_directories.yml" ], "tags": [ @@ -39320,10 +39482,10 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008", "https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html", - "https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/", "https://github.com/olafhartong/sysmon-modular/blob/fa1ae53132403d262be2bbd7f17ceea7e15e8c78/11_file_create/include_dotnet.xml", + "https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008", + "https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_net_cli_artefact.yml" ], "tags": [ @@ -39356,9 +39518,9 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs", "https://thedfirreport.com/2020/11/23/pysa-mespinoza-ransomware/", "https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Output.cs", + "https://github.com/Kevin-Robertson/Inveigh/blob/29d9e3c3a625b3033cdaf4683efaafadcecb9007/Inveigh/Support/Control.cs", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_hktl_inveigh_artefacts.yml" ], "tags": [ @@ -39391,9 +39553,9 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ + "https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g", "https://twitter.com/orange_8361/status/1518970259868626944?s=20&t=RFXqZjtA7tWM3HxqEH78Aw", "https://lolbas-project.github.io/lolbas/Binaries/Eventvwr/#execute", - "https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_uac_bypass_eventvwr.yml" ], "tags": [ @@ -39417,9 +39579,9 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html", - "https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/", "https://www.gteltsc.vn/blog/canh-bao-chien-dich-tan-cong-su-dung-lo-hong-zero-day-tren-microsoft-exchange-server-12714.html", + "https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/", + "https://en.gteltsc.vn/blog/cap-nhat-nhe-ve-lo-hong-bao-mat-0day-microsoft-exchange-dang-duoc-su-dung-de-tan-cong-cac-to-chuc-tai-viet-nam-9685.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_exchange_webshell_drop.yml" ], "tags": [ @@ -39492,8 +39654,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/", "https://github.com/outflanknl/Dumpert", + "https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_hktl_dumpert.yml" ], "tags": [ @@ -39835,8 +39997,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder", "https://redcanary.com/blog/intelligence-insights-october-2021/", + "https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1547.001/T1547.001.md#atomic-test-7---add-executable-shortcut-link-to-user-startup-folder", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_powershell_startup_shortcuts.yml" ], "tags": [ @@ -39869,8 +40031,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md", "https://docs.microsoft.com/en-us/deployoffice/compat/office-file-format-reference", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_macro_files_from_susp_process.yml" ], "tags": [ @@ -40004,9 +40166,9 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb", - "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1", "https://github.com/SecureAuthCorp/impacket/blob/7d2991d78836b376452ca58b3d14daa61b67cb40/impacket/examples/secretsdump.py#L2405", + "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/data/post/powershell/NTDSgrab.ps1", + "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/post/windows/gather/ntds_grabber.rb", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_ntds_exfil_tools.yml" ], "tags": [ @@ -40141,8 +40303,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://twitter.com/SBousseaden/status/1278977301745741825", "https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/", + "https://twitter.com/SBousseaden/status/1278977301745741825", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_desktopimgdownldr_file.yml" ], "tags": [ @@ -40209,8 +40371,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "Internal Research", "https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_powershell_module_susp_creation.yml" ], "tags": [ @@ -40234,10 +40396,10 @@ "logsource.product": "windows", "refs": [ "https://github.com/HuskyHacks/ShadowSteal", - "https://github.com/cube0x0/CVE-2021-36934", "https://github.com/search?q=CVE-2021-36934", - "https://github.com/FireFart/hivenightmare", "https://www.google.com/search?q=%22reg.exe+save%22+sam", + "https://github.com/cube0x0/CVE-2021-36934", + "https://github.com/FireFart/hivenightmare", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_sam_dump.yml" ], "tags": [ @@ -40876,8 +41038,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/GhostPack/SafetyKatz/blob/715b311f76eb3a4c8d00a1bd29c6cd1899e450b7/SafetyKatz/Program.cs#L63", "https://github.com/GhostPack/SafetyKatz", + "https://github.com/GhostPack/SafetyKatz/blob/715b311f76eb3a4c8d00a1bd29c6cd1899e450b7/SafetyKatz/Program.cs#L63", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_hktl_safetykatz.yml" ], "tags": [ @@ -40943,10 +41105,10 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/", - "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-spam-campaign-uses-iso-image-files-to-deliver-lokibot-and-nanocore", + "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/", "https://blog.emsisoft.com/en/32373/beware-new-wave-of-malware-spreads-via-iso-file-email-attachments/", + "https://insights.sei.cmu.edu/blog/the-dangers-of-vhd-and-vhdx-files/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_iso_file_recent.yml" ], "tags": [ @@ -41078,8 +41240,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/last-byte/PersistenceSniper", "https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/", + "https://github.com/last-byte/PersistenceSniper", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_errorhandler_persistence.yml" ], "tags": [ @@ -41102,9 +41264,9 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ + "https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/", "https://github.com/fox-it/LDAPFragger", "https://medium.com/@ivecodoe/detecting-ldapfragger-a-newly-released-cobalt-strike-beacon-using-ldap-for-c2-communication-c274a7f00961", - "https://blog.fox-it.com/2020/03/19/ldapfragger-command-and-control-over-ldap-attributes/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_susp_adsi_cache_usage.yml" ], "tags": [ @@ -41239,8 +41401,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md", "https://docs.microsoft.com/en-us/deployoffice/compat/office-file-format-reference", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_macro_files_downloaded.yml" ], "tags": [ @@ -41273,10 +41435,10 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory", "https://www.mandiant.com/resources/blog/fin7-shim-databases-persistence", - "https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/", "https://liberty-shell.com/sec/2020/02/25/shim-persistence/", + "https://andreafortuna.org/2018/11/12/process-injection-and-persistence-using-application-shimming/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.011/T1546.011.md#atomic-test-2---new-shim-database-files-created-in-the-default-shim-database-directory", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_creation_new_shim_database.yml" ], "tags": [ @@ -41297,18 +41459,19 @@ "value": "New Shim Database Created in the Default Directory" }, { - "description": "Possible webshell file creation on a static web site", + "description": "Detects the creation of files with certain extensions on a static web site. This can be indicative of potential uploads of a web shell.", "meta": { - "author": "Beyu Denis, oscd.community, Tim Shelton", + "author": "Beyu Denis, oscd.community, Tim Shelton, Thurein Oo", "creation_date": "2019/10/22", "falsepositive": [ "Legitimate administrator or developer creating legitimate executable files in a web application folder" ], "filename": "file_event_win_webshell_creation_detect.yml", - "level": "high", + "level": "medium", "logsource.category": "file_event", "logsource.product": "windows", "refs": [ + "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/c95a0a1a2855dc0cd7f7327614545fe30482a636/Upload%20Insecure%20Files/README.md", "PT ESC rule and personal experience", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_webshell_creation_detect.yml" ], @@ -41327,7 +41490,7 @@ } ], "uuid": "39f1f9f2-9636-45de-98f6-a4046aa8e4b9", - "value": "Windows Webshell Creation" + "value": "Potential Webshell Creation On Static Website" }, { "description": "Get-Variable is a valid PowerShell cmdlet\nWindowsApps is by default in the path where PowerShell is executed.\nSo when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.\n", @@ -41418,8 +41581,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md", "https://docs.microsoft.com/en-us/deployoffice/compat/office-file-format-reference", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1566.001/T1566.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_office_macro_files_created.yml" ], "tags": [ @@ -41620,12 +41783,12 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ + "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992", + "https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc", "https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/", + "https://github.com/Wh04m1001/SysmonEoP", "https://decoded.avast.io/martinchlumecky/png-steganography/", "https://clement.notin.org/blog/2020/09/12/CVE-2020-7315-McAfee-Agent-DLL-injection/", - "https://github.com/Wh04m1001/SysmonEoP", - "https://github.com/blackarrowsec/redteam-research/tree/26e6fc0c0d30d364758fa11c2922064a9a7fd309/LPE%20via%20StorSvc", - "https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_create_non_existent_dlls.yml" ], "tags": [ @@ -41710,8 +41873,8 @@ "logsource.category": "file_event", "logsource.product": "windows", "refs": [ - "Internal Research", "https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_event/file_event_win_powershell_module_uncommon_creation.yml" ], "tags": [ @@ -41838,8 +42001,8 @@ "logsource.category": "file_rename", "logsource.product": "windows", "refs": [ - "https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/", "https://app.any.run/tasks/d66ead5a-faf4-4437-93aa-65785afaf9e5/", + "https://blog.cyble.com/2022/08/10/onyx-ransomware-renames-its-leak-site-to-vsop/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_rename/file_rename_win_ransomware.yml" ], "tags": [ @@ -41973,8 +42136,8 @@ "logsource.category": "file_delete", "logsource.product": "windows", "refs": [ - "https://github.com/cube0x0/CVE-2021-1675", "https://github.com/hhlxf/PrintNightmare", + "https://github.com/cube0x0/CVE-2021-1675", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_delete/file_delete_win_cve_2021_1675_print_nightmare.yml" ], "tags": [ @@ -42243,8 +42406,8 @@ "logsource.category": "file_delete", "logsource.product": "windows", "refs": [ - "Internal Research", "https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_delete/file_delete_win_zone_identifier_ads_uncommon.yml" ], "tags": [ @@ -42313,8 +42476,8 @@ "logsource.category": "file_access", "logsource.product": "windows", "refs": [ - "https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users", "https://github.com/lclevy/firepwd", + "https://www.zscaler.com/blogs/security-research/ffdroider-stealer-targeting-social-media-platform-users", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_access/file_access_win_browser_credential_access.yml" ], "tags": [ @@ -42347,8 +42510,8 @@ "logsource.category": "file_access", "logsource.product": "windows", "refs": [ - "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords", "http://blog.harmj0y.net/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/", + "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_access/file_access_win_dpapi_master_key_access.yml" ], "tags": [ @@ -42415,8 +42578,8 @@ "logsource.category": "file_access", "logsource.product": "windows", "refs": [ - "https://www.passcape.com/windows_password_recovery_dpapi_credhist", "https://tools.thehacker.recipes/mimikatz/modules/dpapi/credhist", + "https://www.passcape.com/windows_password_recovery_dpapi_credhist", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/file/file_access/file_access_win_susp_cred_hist_access.yml" ], "tags": [ @@ -42583,10 +42746,10 @@ "logsource.product": "windows", "refs": [ "https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/hunting-for-omi-vulnerability-exploitation-with-azure-sentinel/ba-p/2764093", + "https://redcanary.com/blog/misbehaving-rats/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-3---logmein-files-detected-test-on-windows", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-6---ammyy-admin-software-execution", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1219/T1219.md#atomic-test-4---gotoassist-files-detected-test-on-windows", - "https://redcanary.com/blog/misbehaving-rats/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers.yml" ], "tags": [ @@ -42819,8 +42982,8 @@ "logsource.category": "dns_query", "logsource.product": "windows", "refs": [ - "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns", "https://www.sekoia.io/en/hunting-and-detecting-cobalt-strike/", + "https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/dns_query/dns_query_win_mal_cobaltstrike.yml" ], "tags": [ @@ -42964,12 +43127,12 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html", - "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176", - "https://redcanary.com/blog/raspberry-robin/", - "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", + "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/", + "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html", + "https://redcanary.com/blog/raspberry-robin/", + "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr.yml" ], "tags": [ @@ -43059,9 +43222,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/", "http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/", "http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/", - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_squirrel.yml" ], "tags": [ @@ -43185,8 +43348,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/sblmsrsn/status/1445758411803480072?s=20", - "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2", "https://lolbas-project.github.io/lolbas/Binaries/Certoc/", + "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml" ], "tags": [ @@ -43288,8 +43451,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1638069413717975046", "https://docs.microsoft.com/en-us/sysinternals/downloads/pssuspend", + "https://twitter.com/0gtweet/status/1638069413717975046", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_susp_execution.yml" ], "tags": [ @@ -43322,8 +43485,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/", "https://docs.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool", + "https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution.yml" ], "tags": [ @@ -43370,11 +43533,11 @@ "logsource.product": "windows", "refs": [ "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/", + "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md", + "https://www.joeware.net/freetools/tools/adfind/", "https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx", "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/", "https://thedfirreport.com/2020/05/08/adfind-recon/", - "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md", - "https://www.joeware.net/freetools/tools/adfind/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_adfind.yml" ], "tags": [ @@ -43548,8 +43711,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/", "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment", + "https://blog.cobaltstrike.com/2014/04/02/what-happens-when-i-type-getsystem/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_meterpreter_getsystem.yml" ], "tags": [ @@ -43689,8 +43852,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/countuponsec/status/910977826853068800", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqldumper/", + "https://twitter.com/countuponsec/status/910977826853068800", "https://twitter.com/countuponsec/status/910969424215232518", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_sqldumper_activity.yml" ], @@ -43725,8 +43888,8 @@ "logsource.product": "windows", "refs": [ "https://lolbas-project.github.io/lolbas/Binaries/Regasm/", - "https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/", "https://www.fortiguard.com/threat-signal-report/4718?s=09", + "https://lolbas-project.github.io/lolbas/Binaries/Regsvcs/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regasm_suspicious_execution.yml" ], "tags": [ @@ -43792,8 +43955,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://h.43z.one/ipconverter/", "https://twitter.com/Yasser_Elsnbary/status/1553804135354564608", + "https://h.43z.one/ipconverter/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_via_cli.yml" ], "tags": [ @@ -43998,8 +44161,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/", + "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_whoami_parent_anomaly.yml" ], @@ -44034,8 +44197,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/shantanu561993/SharpChisel", "https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/", + "https://github.com/shantanu561993/SharpChisel", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_chisel.yml" ], "tags": [ @@ -44068,8 +44231,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/", + "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://www.youtube.com/watch?v=DsJ9ByX84o4&t=6s", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_whoami_susp_flags.yml" ], @@ -44137,13 +44300,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/", - "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware", - "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/", - "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", - "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow", - "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4", "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf", + "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", + "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/", + "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4", + "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow", + "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware", + "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml" ], "tags": [ @@ -44177,12 +44340,12 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp", - "https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/", "https://twitter.com/xorJosh/status/1598646907802451969", - "https://ngrok.com/docs", "https://www.softwaretestinghelp.com/how-to-use-ngrok/", "https://www.virustotal.com/gui/file/58d21840d915aaf4040ceb89522396124c82f325282f805d1085527e1e2ccfa1/detection", + "https://stackoverflow.com/questions/42442320/ssh-tunnel-to-ngrok-and-initiate-rdp", + "https://ngrok.com/docs", + "https://cybleinc.com/2021/02/15/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_ngrok.yml" ], @@ -44250,8 +44413,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/1ZRR4H/status/1534259727059787783", "https://app.any.run/tasks/e1fe6a62-bce8-4323-a49a-63795d9afd5d/", + "https://twitter.com/1ZRR4H/status/1534259727059787783", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_archiver_iso_phishing.yml" ], "tags": [ @@ -44284,14 +44447,14 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest", - "https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters", - "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/", - "https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html", - "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/", - "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)", "https://thedfirreport.com/2021/08/16/trickbot-leads-up-to-fake-1password-installation/", + "https://book.hacktricks.xyz/windows/basic-cmd-for-pentesters", + "https://github.com/redcanaryco/atomic-red-team/blob/5360c9d9ffa3b25f6495f7a16e267b719eba2c37/atomics/T1482/T1482.md#atomic-test-2---windows---discover-domain-trusts-with-nltest", + "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)", + "https://eqllib.readthedocs.io/en/latest/analytics/03e231a6-74bc-467a-acb1-e5676b0fb55e.html", "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/", + "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/", + "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_nltest_recon.yml" ], "tags": [ @@ -44332,10 +44495,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/", "https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf", "https://github.com/hfiref0x/UACME", "https://twitter.com/hFireF0X/status/897640081053364225", - "https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_cmstp_com_object_access.yml" ], "tags": [ @@ -44417,8 +44580,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/nas_bench/status/1535431474429808642", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/", + "https://twitter.com/nas_bench/status/1535431474429808642", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wsl_lolbin_execution.yml" ], "tags": [ @@ -44460,9 +44623,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://thedfirreport.com/2023/03/06/2022-year-in-review/", "https://learn.microsoft.com/en-us/answers/questions/253555/software-list-inventory-wmic-product", "https://www.yeahhub.com/list-installed-programs-version-path-windows/", - "https://thedfirreport.com/2023/03/06/2022-year-in-review/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_product.yml" ], "tags": [ @@ -44495,10 +44658,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://mez0.cc/posts/cobaltstrike-powershell-exec/", - "https://zero2auto.com/2020/05/19/netwalker-re/", - "https://redcanary.com/blog/yellow-cockatoo/", "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65", + "https://mez0.cc/posts/cobaltstrike-powershell-exec/", + "https://redcanary.com/blog/yellow-cockatoo/", + "https://zero2auto.com/2020/05/19/netwalker-re/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml" ], "tags": [ @@ -44548,8 +44711,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://redcanary.com/blog/intelligence-insights-december-2021", "https://www.synacktiv.com/en/publications/how-to-exploit-cve-2021-40539-on-manageengine-adselfservice-plus.html", + "https://redcanary.com/blog/intelligence-insights-december-2021", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_java_keytool_susp_child_process.yml" ], "tags": [ @@ -44656,9 +44819,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md", "https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx", "https://www.joeware.net/freetools/tools/adfind/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.002/T1087.002.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_adfind_enumeration.yml" ], "tags": [ @@ -44837,8 +45000,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/Gal_B1t/status/1062971006078345217", "https://twitter.com/hexacorn/status/1448037865435320323", + "https://twitter.com/Gal_B1t/status/1062971006078345217", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_commandline_path_traversal_evasion.yml" ], "tags": [ @@ -45027,16 +45190,16 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38", - "http://managed670.rssing.com/chan-5590147/all_p1.html", "https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf", + "http://managed670.rssing.com/chan-5590147/all_p1.html", + "https://github.com/dotnet/runtime/blob/f62e93416a1799aecc6b0947adad55a0d9870732/src/coreclr/src/inc/clrconfigvalues.h#L35-L38", "https://github.com/dotnet/runtime/blob/ee2355c801d892f2894b0f7b14a20e6cc50e0e54/docs/design/coreclr/jit/viewing-jit-dumps.md#setting-configuration-variables", "https://bunnyinside.com/?term=f71e8cb9c76a", - "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39", - "https://twitter.com/_xpn_/status/1268712093928378368", - "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_", - "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr", "https://github.com/dotnet/runtime/blob/4f9ae42d861fcb4be2fcd5d3d55d5f227d30e723/docs/coding-guidelines/clr-jit-coding-conventions.md#1412-disabling-code", + "https://social.msdn.microsoft.com/Forums/vstudio/en-US/0878832e-39d7-4eaf-8e16-a729c4c40975/what-can-i-use-e13c0d23ccbc4e12931bd9cc2eee27e4-for?forum=clr", + "https://github.com/dotnet/runtime/blob/7abe42dc1123722ed385218268bb9fe04556e3d3/src/coreclr/src/inc/clrconfig.h#L33-L39", + "https://github.com/dotnet/runtime/search?p=1&q=COMPlus_&unscoped_q=COMPlus_", + "https://twitter.com/_xpn_/status/1268712093928378368", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_etw_modification_cmdline.yml" ], "tags": [ @@ -45069,8 +45232,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1457676633809330184", "https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/", + "https://twitter.com/0gtweet/status/1457676633809330184", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_sigverif.yml" ], "tags": [ @@ -45103,8 +45266,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change", "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-change", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_schedule_type.yml" ], @@ -45139,9 +45302,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://www.poweradmin.com/paexec/", "https://docs.microsoft.com/en-us/sysinternals/downloads/psexec", - "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags_.yml" ], "tags": [ @@ -45174,8 +45337,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples", "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65", + "https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml" ], "tags": [ @@ -45217,8 +45380,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1638069413717975046", "https://learn.microsoft.com/en-us/sysinternals/downloads/pssuspend", + "https://twitter.com/0gtweet/status/1638069413717975046", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_pssuspend_execution.yml" ], "tags": [ @@ -45318,9 +45481,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/jonasLyk/status/1555914501802921984", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)?redirectedfrom=MSDN", "https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/", - "https://twitter.com/jonasLyk/status/1555914501802921984", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_cli.yml" ], "tags": [ @@ -45570,8 +45733,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1628720819537936386", "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/", + "https://twitter.com/0gtweet/status/1628720819537936386", "https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_sdset_allow_service_changes.yml" ], @@ -45605,8 +45768,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "Internal Research", "https://linux.die.net/man/1/bash", + "Internal Research", "https://lolbas-project.github.io/lolbas/Binaries/Bash/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bash_file_execution.yml" ], @@ -45640,8 +45803,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/", "https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html", + "https://unit42.paloaltonetworks.com/bumblebee-webshell-xhunt-campaign/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_webshell_detection.yml" ], "tags": [ @@ -45698,8 +45861,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html", "https://blog.talosintelligence.com/modernloader-delivers-multiple-stealers-cryptominers-and-rats/", + "https://web.archive.org/web/20220830122045/http://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mshta_inline_vbscript.yml" ], "tags": [ @@ -46006,8 +46169,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3", "https://twitter.com/splinter_code/status/1483815103279603714", + "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3", "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", "https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun.yml" @@ -46127,9 +46290,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://github.com/GhostPack/Rubeus", "https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus", + "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_rubeus.yml" ], "tags": [ @@ -46245,10 +46408,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/", - "https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/", - "https://twitter.com/Z3Jpa29z/status/1317545798981324801", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/", + "https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/", + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/", + "https://twitter.com/Z3Jpa29z/status/1317545798981324801", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_csi_execution.yml" ], "tags": [ @@ -46323,8 +46486,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/", "https://github.com/S3cur3Th1sSh1t/SharpImpersonation", + "https://s3cur3th1ssh1t.github.io/SharpImpersonation-Introduction/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_sharp_impersonation.yml" ], "tags": [ @@ -46468,8 +46631,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html", "https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462", + "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml" ], "tags": [ @@ -46645,8 +46808,8 @@ "logsource.product": "windows", "refs": [ "https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js", - "https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/", "https://blog.f-secure.com/hunting-for-koadic-a-com-based-rootkit/", + "https://unit42.paloaltonetworks.com/unit42-sofacy-groups-parallel-attacks/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_koadic.yml" ], "tags": [ @@ -46762,8 +46925,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/tutorial-for-ntds-goodness-vssadmin-wmis-ntdsdit-system/", + "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_creation.yml" ], "tags": [ @@ -46879,8 +47042,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv", + "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_custom_user_agent.yml" ], "tags": [ @@ -47054,8 +47217,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3", "https://twitter.com/splinter_code/status/1483815103279603714", + "https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3", "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", "https://elastic.github.io/security-research/malware/2022/01/01.operation-bleeding-bear/article/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_advancedrun_priv_user.yml" @@ -47126,8 +47289,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/vxunderground/status/1423336151860002816?s=20", "https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection", + "https://twitter.com/vxunderground/status/1423336151860002816?s=20", "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_malware_conti_shadowcopy.yml" ], @@ -47162,9 +47325,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos", "https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/", "https://twitter.com/EricaZelic/status/1614075109827874817", - "https://www.cybereason.com/blog/deadringer-exposing-chinese-threat-actors-targeting-major-telcos", "https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Sysinternals/PsLogList", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_psloglist.yml" ], @@ -47282,8 +47445,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/pabraeken/status/999090532839313408", "https://twitter.com/pabraeken/status/995837734379032576", + "https://twitter.com/pabraeken/status/999090532839313408", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml" ], @@ -47351,8 +47514,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/", "https://twitter.com/0gtweet/status/1206692239839289344", + "https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml" ], "tags": [ @@ -47419,8 +47582,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv", + "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wget_download_susp_file_sharing_domains.yml" ], "tags": [ @@ -47443,8 +47606,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html", + "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_response_file_susp.yml" ], @@ -47478,9 +47641,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/", "https://www.bleepingcomputer.com/news/security/iobit-forums-hacked-to-spread-ransomware-to-its-members/", "https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1562.001/T1562.001.md", - "https://www.bleepingcomputer.com/news/security/gootkit-malware-bypasses-windows-defender-by-setting-path-exclusions/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_namespace_defender.yml" ], "tags": [ @@ -47614,8 +47777,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://dtm.uk/wuauclt/", "https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/", + "https://dtm.uk/wuauclt/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_wuauclt.yml" ], "tags": [ @@ -47649,8 +47812,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://redcanary.com/blog/right-to-left-override/", "https://unicode-explorer.com/c/202E", + "https://redcanary.com/blog/right-to-left-override/", "https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_right_to_left_override.yml" ], @@ -47684,9 +47847,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/", "https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf", "https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2", - "https://www.carbonblack.com/2014/06/10/screenshot-demo-hunt-evil-faster-than-ever-with-carbon-black/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_proc_wrong_parent.yml" ], "tags": [ @@ -47729,8 +47892,8 @@ "refs": [ "https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior", "https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior", - "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior", "https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior", + "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_location.yml" ], "tags": [ @@ -47763,8 +47926,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/", "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", + "https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_redirect_local_admin_share.yml" ], "tags": [ @@ -47830,14 +47993,14 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", - "https://twitter.com/Hexacorn/status/776122138063409152", "https://reaqta.com/2017/12/mavinject-microsoft-injector/", + "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md", + "https://twitter.com/Hexacorn/status/776122138063409152", + "https://github.com/SigmaHQ/sigma/issues/3742", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", "https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection", "https://twitter.com/gN3mes1s/status/941315826107510784", - "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e", - "https://github.com/SigmaHQ/sigma/issues/3742", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_mavinject.yml" ], "tags": [ @@ -47879,9 +48042,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Shells/Invoke-PowerShellTcpOneLine.ps1", "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", + "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml" ], "tags": [ @@ -48014,8 +48177,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/cyb3rops/status/1562072617552678912", "https://ss64.com/nt/cmd.html", + "https://twitter.com/cyb3rops/status/1562072617552678912", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml" ], "tags": [ @@ -48133,9 +48296,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/", "https://github.com/nccgroup/redsnarf/blob/35949b30106ae543dc6f2bc3f1be10c6d9a8d40e/redsnarf.py", "https://github.com/S3cur3Th1sSh1t/Creds/blob/eac23d67f7f90c7fc8e3130587d86158c22aa398/PowershellScripts/jaws-enum.ps1", - "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_unquoted_service_search.yml" ], "tags": [ @@ -48168,8 +48331,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/SBousseaden/status/1278977301745741825", "https://labs.sentinelone.com/living-off-windows-land-a-new-native-file-downldr/", + "https://twitter.com/SBousseaden/status/1278977301745741825", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_desktopimgdownldr_susp_execution.yml" ], "tags": [ @@ -48236,10 +48399,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/", "https://twitter.com/Hexacorn/status/885553465417756673", "https://twitter.com/vysecurity/status/885545634958385153", "https://twitter.com/Hexacorn/status/885570278637678592", - "https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/", "https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion-techniques", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_escape_char.yml" ], @@ -48433,8 +48596,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows", "https://blog.cyble.com/2022/04/21/prynt-stealer-a-new-info-stealer-performing-clipper-and-keylogger-activities/", + "https://github.com/redcanaryco/atomic-red-team/blob/84d9edaaaa2c5511144521b0e4af726d1c7276ce/atomics/T1539/T1539.md#atomic-test-2---steal-chrome-cookies-windows", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sqlite_chromium_profile_data.yml" ], "tags": [ @@ -48537,7 +48700,7 @@ "Unknown" ], "filename": "proc_creation_win_susp_elevated_system_shell.yml", - "level": "high", + "level": "medium", "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ @@ -48561,7 +48724,7 @@ } ], "uuid": "178e615d-e666-498b-9630-9ed363038101", - "value": "Suspicious Elevated System Shell" + "value": "Elevated System Shell Spawned" }, { "description": "Detects potentially suspicious child processes spawned by PowerShell", @@ -48673,8 +48836,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://securelist.com/locked-out/68960/", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1486/T1486.md", + "https://securelist.com/locked-out/68960/", "https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpg4win_portable_execution.yml" ], @@ -48709,8 +48872,8 @@ "logsource.product": "windows", "refs": [ "https://github.com/horizon3ai/CVE-2022-47966/blob/3a51c6b72ebbd87392babd955a8fbeaee2090b35/CVE-2022-47966.py", - "https://blog.viettelcybersecurity.com/saml-show-stopper/", "https://www.horizon3.ai/manageengine-cve-2022-47966-technical-deep-dive/", + "https://blog.viettelcybersecurity.com/saml-show-stopper/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_java_manageengine_susp_child_process.yml" ], "tags": [ @@ -48744,8 +48907,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html", "https://www.dfirnotes.net/portproxy_detection/", + "https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html", "https://adepts.of0x.cc/netsh-portproxy-code/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml" ], @@ -48781,8 +48944,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/", "https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/", + "https://bohops.com/2021/10/08/analyzing-and-detecting-a-vmtools-persistence-technique/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_vmware_toolbox_cmd_persistence.yml" ], "tags": [ @@ -49132,8 +49295,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/", "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/", + "https://threatpost.com/maze-ransomware-ragnar-locker-virtual-machine/159350/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_virtualbox_execution.yml" ], "tags": [ @@ -49207,10 +49370,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/", - "https://github.com/defaultnamehere/cookie_crimes/", "https://embracethered.com/blog/posts/2020/cookie-crimes-on-mirosoft-edge/", + "https://embracethered.com/blog/posts/2020/chrome-spy-remote-control/", "https://mango.pdf.zone/stealing-chrome-cookies-without-a-password", + "https://github.com/defaultnamehere/cookie_crimes/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_headless_debugging.yml" ], "tags": [ @@ -49386,8 +49549,8 @@ "logsource.product": "windows", "refs": [ "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/", - "https://lolbas-project.github.io/lolbas/Binaries/Certutil/", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", + "https://lolbas-project.github.io/lolbas/Binaries/Certutil/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_encode.yml" ], "tags": [ @@ -49454,8 +49617,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/", "https://twitter.com/swisscom_csirt/status/1331634525722521602?s=20", + "https://app.any.run/tasks/f74c5157-8508-4ac6-9805-d63fe7b0d399/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_rundll32_dllregisterserver.yml" ], "tags": [ @@ -49512,8 +49675,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://pentestlab.blog/2017/03/30/weak-service-permissions/", "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment", + "https://pentestlab.blog/2017/03/30/weak-service-permissions/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_change_sevice_image_path_by_non_admin.yml" ], "tags": [ @@ -49582,8 +49745,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/chcp", + "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_chcp_codepage_lookup.yml" ], "tags": [ @@ -49616,8 +49779,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/mandiant/SharPersist", "https://www.mandiant.com/resources/blog/sharpersist-windows-persistence-toolkit", + "https://github.com/mandiant/SharPersist", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_sharpersist.yml" ], "tags": [ @@ -49724,8 +49887,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", "https://github.com/3proxy/3proxy", + "https://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_3proxy_execution.yml" ], "tags": [ @@ -49759,8 +49922,8 @@ "logsource.product": "windows", "refs": [ "https://www.activecyber.us/activelabs/windows-uac-bypass", - "https://twitter.com/ReaQta/status/1222548288731217921", "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/", + "https://twitter.com/ReaQta/status/1222548288731217921", "https://eqllib.readthedocs.io/en/latest/analytics/532b5ed4-7930-11e9-8f5c-d46d6d62a49e.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset.yml" ], @@ -49795,9 +49958,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://docs.python.org/3/using/cmdline.html#cmdoption-c", "https://www.revshells.com/", "https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", - "https://docs.python.org/3/using/cmdline.html#cmdoption-c", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_python_inline_command_execution.yml" ], "tags": [ @@ -49956,8 +50119,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://nsudo.m2team.org/en-us/", "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment", + "https://nsudo.m2team.org/en-us/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_whoami_execution_from_high_priv_process.yml" ], "tags": [ @@ -50041,15 +50204,15 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware", + "https://blog.talosintelligence.com/2017/05/wannacry.html", + "https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/", + "https://github.com/Neo23x0/Raccine#the-process", "https://redcanary.com/blog/intelligence-insights-october-2021/", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", - "https://www.bleepingcomputer.com/news/security/why-everyone-should-disable-vssadmin-exe-now/", - "https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar", - "https://blog.talosintelligence.com/2017/05/wannacry.html", "https://securingtomorrow.mcafee.com/other-blogs/mcafee-labs/new-teslacrypt-ransomware-arrives-via-spam/", - "https://github.com/Neo23x0/Raccine#the-process", "https://www.hybrid-analysis.com/sample/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa?environmentId=100", + "https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/gen_ransomware_command_lines.yar", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml" ], "tags": [ @@ -50091,8 +50254,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml", "Turla has used fsutil fsinfo drives to list connected drives.", + "https://github.com/elastic/detection-rules/blob/414d32027632a49fb239abb8fbbb55d3fa8dd861/rules/windows/discovery_peripheral_device.toml", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fsutil_drive_enumeration.yml" ], "tags": [ @@ -50159,11 +50322,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Ssh/", - "https://github.com/LOLBAS-Project/LOLBAS/pull/211/files", - "https://man.openbsd.org/ssh_config#LocalCommand", - "https://gtfobins.github.io/gtfobins/ssh/", "https://man.openbsd.org/ssh_config#ProxyCommand", + "https://lolbas-project.github.io/lolbas/Binaries/Ssh/", + "https://gtfobins.github.io/gtfobins/ssh/", + "https://man.openbsd.org/ssh_config#LocalCommand", + "https://github.com/LOLBAS-Project/LOLBAS/pull/211/files", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_ssh.yml" ], "tags": [ @@ -50196,8 +50359,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv", + "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_download_direct_ip.yml" ], "tags": [ @@ -50220,8 +50383,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit", "https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d", + "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_secedit_execution.yml" ], "tags": [ @@ -50362,9 +50525,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/09/26/bumblebee-round-two/", - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime", "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime", + "https://thedfirreport.com/2022/09/26/bumblebee-round-two/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wab_execution_from_non_default_location.yml" ], "tags": [ @@ -50388,9 +50551,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://isc.sans.edu/diary/22264", "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/", "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", + "https://isc.sans.edu/diary/22264", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download.yml" ], "tags": [ @@ -50433,10 +50596,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "Internal Research", - "https://twitter.com/Max_Mal_/status/1633863678909874176", "https://techcommunity.microsoft.com/t5/microsoft-365-blog/new-security-hardening-policies-for-trusted-documents/ba-p/3023465", + "https://twitter.com/Max_Mal_/status/1633863678909874176", "https://twitter.com/_JohnHammond/status/1588155401752788994", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_exec_from_trusted_locations.yml" ], "tags": [ @@ -50610,13 +50773,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool", - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32", - "https://docs.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool#feedback", - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32", - "https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/", - "https://www.cobaltstrike.com/help-opsec", "https://twitter.com/CyberRaiju/status/1251492025678983169", + "https://docs.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool#feedback", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32", + "https://docs.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool", + "https://blog.malwarebytes.com/malwarebytes-news/2020/10/kraken-attack-abuses-wer-service/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/regsvr32", + "https://www.cobaltstrike.com/help-opsec", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_bad_opsec_sacrificial_processes.yml" ], "tags": [ @@ -50649,10 +50812,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", - "https://twitter.com/egre55/status/1087685529016193025", "https://lolbas-project.github.io/lolbas/Binaries/Certutil/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", "https://forensicitguy.github.io/agenttesla-vba-certutil-download/", + "https://twitter.com/egre55/status/1087685529016193025", "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_download_direct_ip.yml" ], @@ -50852,8 +51015,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/decoder-it/LocalPotato", "https://www.localpotato.com/localpotato_html/LocalPotato.html", + "https://github.com/decoder-it/LocalPotato", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_localpotato.yml" ], "tags": [ @@ -50878,8 +51041,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/sensepost/impersonate", "https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/", + "https://github.com/sensepost/impersonate", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_impersonate.yml" ], "tags": [ @@ -51014,9 +51177,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://docs.microsoft.com/en-us/windows/package-manager/winget/install#local-install", "https://lolbas-project.github.io/lolbas/Binaries/Winget/", + "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winget_local_install_via_manifest.yml" ], "tags": [ @@ -51084,8 +51247,8 @@ "logsource.product": "windows", "refs": [ "https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/", - "https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell", "https://docs.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps", + "https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml" ], "tags": [ @@ -51152,8 +51315,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b", "https://twitter.com/x86matthew/status/1505476263464607744?s=12", + "https://svch0st.medium.com/stats-from-hunting-cobalt-strike-beacons-c17e56255f9b", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_parents.yml" ], "tags": [ @@ -51187,9 +51350,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus", "https://twitter.com/AdamTheAnalyst/status/1483497517119590403", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", - "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_defender_exclusion.yml" ], "tags": [ @@ -51245,8 +51408,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/cglyer/status/1183756892952248325", "https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers", + "https://twitter.com/cglyer/status/1183756892952248325", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_chcp_codepage_switch.yml" ], "tags": [ @@ -51312,9 +51475,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/_st0pp3r_/status/1583914515996897281", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md", "https://lolbas-project.github.io/lolbas/Binaries/Msiexec/", - "https://twitter.com/_st0pp3r_/status/1583914515996897281", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msiexec_dll.yml" ], "tags": [ @@ -51426,8 +51589,8 @@ "logsource.product": "windows", "refs": [ "https://www.documentcloud.org/documents/5743766-Global-Threat-Report-2019.html", - "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)", "https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit", + "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ldifde_export.yml" ], "tags": [ @@ -51540,9 +51703,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/samratashok/ADModule", - "https://twitter.com/cyb3rops/status/1617108657166061568?s=20", "https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges", + "https://twitter.com/cyb3rops/status/1617108657166061568?s=20", + "https://github.com/samratashok/ADModule", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_active_directory_module_dll_import.yml" ], "tags": [ @@ -51645,10 +51808,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat", - "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43", "https://www.youtube.com/watch?v=JGs-aKf2OtU&ab_channel=OFFZONEMOSCOW", "https://github.com/gladiatx0r/Powerless/blob/04f553bbc0c65baf4e57344deff84e3f016e6b51/Powerless.bat", + "https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e7182501d/winPEAS/winPEASbat/winPEAS.bat", + "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment?slide=43", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_accesschk_check_permissions.yml" ], "tags": [ @@ -51933,8 +52096,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md", "https://securelist.com/to-crypt-or-to-mine-that-is-the-question/86307/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certmgr_certificate_installation.yml" ], "tags": [ @@ -52036,8 +52199,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/mrd0x/status/1475085452784844803?s=12", "https://twitter.com/an0n_r0/status/1474698356635193346?s=12", + "https://twitter.com/mrd0x/status/1475085452784844803?s=12", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_download_office_domain.yml" ], "tags": [ @@ -52079,9 +52242,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://www.poweradmin.com/paexec/", "https://docs.microsoft.com/en-us/sysinternals/downloads/psexec", - "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_paexec_escalate_system.yml" ], "tags": [ @@ -52149,8 +52312,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/", "https://www.echotrail.io/insights/search/defaultpack.exe", + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_defaultpack.yml" ], "tags": [ @@ -52184,10 +52347,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine", "https://uvnc.com/docs/uvnc-viewer/52-ultravnc-viewer-commandline-parameters.html", "https://unit42.paloaltonetworks.com/unit-42-title-gamaredon-group-toolset-evolution", - "https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ultravnc_susp_execution.yml" ], "tags": [ @@ -52221,8 +52384,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/JohnLaTwC/status/1082851155481288706", "https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03", + "https://twitter.com/JohnLaTwC/status/1082851155481288706", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml" ], "tags": [ @@ -52321,9 +52484,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29", "https://thedfirreport.com/2022/04/04/stolen-images-campaign-ends-in-conti-ransomware/", "https://learn.microsoft.com/en-us/windows/win32/secauthz/mandatory-integrity-control", + "https://cybercryptosec.medium.com/covid-19-cyber-infection-c615ead7c29", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_conhost_legacy_option.yml" ], "tags": [ @@ -52390,8 +52553,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive", "https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool", + "https://web.archive.org/web/20220514073704/https://github.com/ch2sh/Jlaive", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_jlaive_batch_execution.yml" ], "tags": [ @@ -52425,8 +52588,8 @@ "logsource.product": "windows", "refs": [ "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml", - "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", "https://twitter.com/ForensicITGuy/status/1334734244120309760", + "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", "https://blog.osarmor.com/319/onenote-attachment-delivers-asyncrat-malware/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmiprvse_susp_child_processes.yml" ], @@ -52477,10 +52640,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://isc.sans.edu/diary/More+Data+Exfiltration/25698", "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation#inside-the-registry", - "https://github.com/HyperSine/how-does-MobaXterm-encrypt-password", + "https://isc.sans.edu/diary/More+Data+Exfiltration/25698", "https://github.com/synacktiv/Radmin3-Password-Cracker/blob/acfc87393e4b7c06353973a14a6c7126a51f36ac/regkey.txt", + "https://github.com/HyperSine/how-does-MobaXterm-encrypt-password", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_enumeration_for_credentials_cli.yml" ], "tags": [ @@ -52603,9 +52766,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/jonasLyk/status/1555914501802921984", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)?redirectedfrom=MSDN", "https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/", - "https://twitter.com/jonasLyk/status/1555914501802921984", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_use_image.yml" ], "tags": [ @@ -52849,9 +53012,9 @@ "logsource.product": "windows", "refs": [ "https://eqllib.readthedocs.io/en/latest/analytics/aed95fc6-5e3f-49dc-8b35-06508613f979.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md", "https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003/T1003.md", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives.yml" ], @@ -52937,8 +53100,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "Internal Research", "https://tools.thehacker.recipes/mimikatz/modules", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_system_user_anomaly.yml" ], "tags": [ @@ -53070,9 +53233,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/", "https://twitter.com/SBousseaden/status/1464566846594691073?s=20", "https://twitter.com/Hexacorn/status/1420053502554951689", + "https://www.matteomalvica.com/blog/2019/12/02/win-defender-atp-cred-bypass/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lsass_process_clone.yml" ], "tags": [ @@ -53113,8 +53276,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/", "https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866", + "https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_mpcmdrun_download.yml" ], "tags": [ @@ -53156,8 +53319,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1674399582162153472", "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/", + "https://twitter.com/0gtweet/status/1674399582162153472", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml" ], "tags": [ @@ -53192,8 +53355,8 @@ "refs": [ "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/atexec.py", "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/dcomexec.py", - "https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html", "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/smbexec.py", + "https://www.elastic.co/guide/en/security/current/suspicious-cmd-execution-via-wmi.html", "https://github.com/SecureAuthCorp/impacket/blob/8b1a99f7c715702eafe3f24851817bb64721b156/examples/wmiexec.py", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_impacket_lateral_movement.yml" ], @@ -53271,8 +53434,8 @@ "logsource.product": "windows", "refs": [ "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f", - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/regini", "https://lolbas-project.github.io/lolbas/Binaries/Regini/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/regini", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regini_execution.yml" ], "tags": [ @@ -53338,13 +53501,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/", - "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware", - "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/", - "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", - "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow", - "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4", "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf", + "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", + "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/", + "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4", + "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow", + "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware", + "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml" ], "tags": [ @@ -53377,10 +53540,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", - "https://isc.sans.edu/diary/22264", "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/", + "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", + "https://isc.sans.edu/diary/22264", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_uncommon_targetfolder.yml" ], "tags": [ @@ -53456,9 +53619,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915", - "https://github.com/electron/rcedit", "https://security.stackexchange.com/questions/210843/is-it-possible-to-change-original-filename-of-an-exe", + "https://github.com/electron/rcedit", + "https://www.virustotal.com/gui/file/02e8e8c5d430d8b768980f517b62d7792d690982b9ba0f7e04163cbc1a6e7915", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_rcedit_execution.yml" ], "tags": [ @@ -53516,9 +53679,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.virustotal.com/gui/file/d609799091731d83d75ec5d1f030571af20c45efeeb94840b67ea09a3283ab65/behavior/C2AE", "https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps", "https://www.virustotal.com/gui/search/content%253A%2522Set-MpPreference%2520-Disable%2522/files", + "https://www.virustotal.com/gui/file/d609799091731d83d75ec5d1f030571af20c45efeeb94840b67ea09a3283ab65/behavior/C2AE", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_defender_disable_feature.yml" ], "tags": [ @@ -53586,8 +53749,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731620(v=ws.11)", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ntdsutil_susp_usage.yml" ], "tags": [ @@ -53620,9 +53783,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation", "https://technet.microsoft.com/en-us/library/cc754243(v=ws.11).aspx", "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1003.005/T1003.005.md#atomic-test-1---cached-credential-dump-via-cmdkey", - "https://www.peew.pw/blog/2017/11/26/exploring-cmdkey-an-edge-case-for-privilege-escalation", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmdkey_recon.yml" ], "tags": [ @@ -53706,10 +53869,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", - "https://isc.sans.edu/diary/22264", "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/", + "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", + "https://isc.sans.edu/diary/22264", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_targetfolder.yml" ], "tags": [ @@ -53930,9 +54093,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://isc.sans.edu/diary/22264", "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/", "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", + "https://isc.sans.edu/diary/22264", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_susp_extensions.yml" ], "tags": [ @@ -53975,8 +54138,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/nas_bench/status/1534916659676422152", "https://twitter.com/nas_bench/status/1534915321856917506", + "https://twitter.com/nas_bench/status/1534916659676422152", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Adplus/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_adplus_memory_dump.yml" ], @@ -54202,10 +54365,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/nas_bench/status/1537896324837781506", + "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd", "https://github.com/GossiTheDog/ThreatHunting/blob/e85884abbf05d5b41efc809ea6532b10b45bd05c/AdvancedHuntingQueries/DogWalk-DiagCab", "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-9015912909545e72ed42cbac4d1e96295e8964579c406d23fd9c47a8091576a0", - "https://irsl.medium.com/the-trouble-with-microsofts-troubleshooters-6e32fc80b8bd", - "https://twitter.com/nas_bench/status/1537896324837781506", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msdt_susp_cab_options.yml" ], "tags": [ @@ -54238,12 +54401,12 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/", - "https://lolbas-project.github.io/lolbas/Binaries/Msedge/", - "https://lolbas-project.github.io/lolbas/Binaries/Teams/", - "https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc", - "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf", "https://positive.security/blog/ms-officecmd-rce", + "https://lolbas-project.github.io/lolbas/Binaries/Teams/", + "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/", + "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf", + "https://chromium.googlesource.com/chromium/chromium/+/master/content/public/common/content_switches.cc", + "https://lolbas-project.github.io/lolbas/Binaries/Msedge/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_electron_exeuction_proxy.yml" ], "tags": [ @@ -54381,8 +54544,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/", "https://github.com/outflanknl/Dumpert", + "https://unit42.paloaltonetworks.com/actors-still-exploiting-sharepoint-vulnerability/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_dumpert.yml" ], "tags": [ @@ -54415,10 +54578,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37", + "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/", "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7", - "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/", - "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml" ], "tags": [ @@ -54600,9 +54763,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/mattifestation/status/1196390321783025666", "https://twitter.com/oulusoyum/status/1191329746069655553", "https://lolbas-project.github.io/lolbas/Binaries/Tttracer/", + "https://twitter.com/mattifestation/status/1196390321783025666", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml" ], "tags": [ @@ -54644,8 +54807,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/", "https://thedfirreport.com/2022/02/07/qbot-likes-to-move-it-move-it/", + "https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/", "https://redcanary.com/threat-detection-report/threats/qbot/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_esentutl_webcache.yml" ], @@ -54679,8 +54842,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f", "https://lolbas-project.github.io/lolbas/Binaries/Findstr/", + "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f", "https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_findstr.yml" ], @@ -54738,10 +54901,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.mandiant.com/resources/telegram-malware-iranian-espionage", - "https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz", - "https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject", "https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local", + "https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz", + "https://www.mandiant.com/resources/telegram-malware-iranian-espionage", + "https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml" ], "tags": [ @@ -55028,8 +55191,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100", "https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100", + "https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_http_appdata.yml" ], "tags": [ @@ -55113,8 +55276,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/", "https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view?usp=sharing", + "https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mmc_mmc20_lateral_movement.yml" ], "tags": [ @@ -55148,8 +55311,8 @@ "logsource.product": "windows", "refs": [ "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/", - "https://www.gpg4win.de/documentation.html", "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html", + "https://www.gpg4win.de/documentation.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpg4win_decryption.yml" ], "tags": [ @@ -55287,8 +55450,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http", "https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode.yml" ], "tags": [ @@ -55354,8 +55517,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.radmin.fr/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1072/T1072.md", + "https://www.radmin.fr/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_radmin.yml" ], "tags": [ @@ -55423,9 +55586,9 @@ "logsource.product": "windows", "refs": [ "https://github.com/defaultnamehere/cookie_crimes/", - "https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf", "https://github.com/wunderwuzzi23/firefox-cookiemonster", "https://www.mdsec.co.uk/2022/10/analysing-lastpass-part-1/", + "https://yoroi.company/wp-content/uploads/2022/05/EternityGroup_report_compressed.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_remote_debugging.yml" ], "tags": [ @@ -55458,8 +55621,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace", "https://twitter.com/0gtweet/status/1474899714290208777?s=12", + "https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dtrace_kernel_dump.yml" ], "tags": [ @@ -55525,8 +55688,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/blackorbird/status/1140519090961825792", "https://blu3-team.blogspot.com/2019/06/misleading-extensions-xlsexe-docexe.html", + "https://twitter.com/blackorbird/status/1140519090961825792", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_double_extension.yml" ], "tags": [ @@ -55559,10 +55722,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Libraries/Setupapi/", - "https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20", "https://gist.githubusercontent.com/bohops/0cc6586f205f3691e04a1ebf1806aabd/raw/baf7b29891bb91e76198e30889fbf7d6642e8974/calc_exe.inf", "https://raw.githubusercontent.com/huntresslabs/evading-autoruns/master/shady.inf", + "https://twitter.com/Z3Jpa29z/status/1313742350292746241?s=20", + "https://lolbas-project.github.io/lolbas/Libraries/Setupapi/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_setupapi_installhinfsection.yml" ], "tags": [ @@ -55628,8 +55791,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/", "https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/", + "https://thedfirreport.com/2022/10/31/follina-exploit-leads-to-domain-compromise/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_guid_task_name.yml" ], "tags": [ @@ -55795,8 +55958,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://unit42.paloaltonetworks.com/unit42-gorgon-group-slithering-nation-state-cybercrime/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mpcmdrun_remove_windows_defender_definition.yml" ], "tags": [ @@ -55862,9 +56025,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/", "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf", "https://twitter.com/RedDrip7/status/1506480588827467785", - "https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_susp_pattern.yml" ], "tags": [ @@ -56006,8 +56169,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/", "https://github.com/LOLBAS-Project/LOLBAS/pull/180", + "https://lolbas-project.github.io/lolbas/Binaries/CustomShellHost/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_customshellhost.yml" ], "tags": [ @@ -56040,9 +56203,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf", "https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08", "https://redcanary.com/blog/child-processes/", + "https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/goofy-guineapig/NCSC-MAR-Goofy-Guineapig.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dllhost_no_cli_execution.yml" ], "tags": [ @@ -56117,8 +56280,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Scripts/CL_LoadAssembly/", "https://bohops.com/2018/01/07/executing-commands-and-bypassing-applocker-with-powershell-diagnostic-scripts/", + "https://lolbas-project.github.io/lolbas/Scripts/CL_LoadAssembly/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_cl_loadassembly.yml" ], "tags": [ @@ -56151,8 +56314,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps", "https://github.com/cloudflare/cloudflared", + "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_cleanup.yml" ], "tags": [ @@ -56337,8 +56500,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/", "https://docs.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys", + "https://app.any.run/tasks/9c0f37bc-867a-4314-b685-e101566766d7/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_add_run_key.yml" ], "tags": [ @@ -56441,8 +56604,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/clip", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1115/T1115.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_clip_execution.yml" ], "tags": [ @@ -56533,8 +56696,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.d7xtech.com/free-software/runx/", "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", + "https://www.d7xtech.com/free-software/runx/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_runxcmd.yml" ], "tags": [ @@ -56568,8 +56731,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f", "https://twitter.com/mrd0x/status/1511415432888131586", + "https://gist.github.com/nasbench/6d58c3c125e2fa1b8f7a09754c1b087f", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/DumpMinitool/", "https://twitter.com/mrd0x/status/1511489821247684615", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dumpminitool_execution.yml" @@ -56646,9 +56809,9 @@ "logsource.product": "windows", "refs": [ "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a", - "https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html", - "https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone", "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware", + "https://labs.sentinelone.com/egregor-raas-continues-the-chaos-with-cobalt-strike-and-rclone", + "https://www.splunk.com/en_us/blog/security/darkside-ransomware-splunk-threat-update-and-detections.html", "https://research.nccgroup.com/2021/05/27/detecting-rclone-an-effective-tool-for-exfiltration/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_rclone_execution.yml" ], @@ -56797,9 +56960,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/", "https://attack.mitre.org/software/S0404/", "https://twitter.com/vxunderground/status/1423336151860002816", + "https://thedfirreport.com/2021/08/01/bazarcall-to-conti-ransomware-via-trickbot-and-cobalt-strike/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_esentutl_params.yml" ], "tags": [ @@ -56917,8 +57080,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://nsudo.m2team.org/en-us/", "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", + "https://nsudo.m2team.org/en-us/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_nsudo.yml" ], "tags": [ @@ -56985,8 +57148,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", + "https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml" ], "tags": [ @@ -57019,8 +57182,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/cglyer/status/1182389676876980224", "https://twitter.com/cglyer/status/1182391019633029120", + "https://twitter.com/cglyer/status/1182389676876980224", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmi_backdoor_exchange_transport_agent.yml" ], "tags": [ @@ -57200,14 +57363,14 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", - "https://twitter.com/Hexacorn/status/776122138063409152", "https://reaqta.com/2017/12/mavinject-microsoft-injector/", + "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.004/T1056.004.md", + "https://twitter.com/Hexacorn/status/776122138063409152", + "https://github.com/SigmaHQ/sigma/issues/3742", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", "https://github.com/keyboardcrunch/SentinelOne-ATTACK-Queries/blob/6a228d23eefe963ca81f2d52f94b815f61ef5ee0/Tactics/DefenseEvasion.md#t1055-process-injection", "https://twitter.com/gN3mes1s/status/941315826107510784", - "https://posts.specterops.io/mavinject-exe-functionality-deconstructed-c29ab2cf5c0e", - "https://github.com/SigmaHQ/sigma/issues/3742", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection.yml" ], "tags": [ @@ -57249,8 +57412,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/", "https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/", + "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_exectuion.yml" ], "tags": [ @@ -57384,8 +57547,8 @@ "logsource.product": "windows", "refs": [ "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=44", - "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html", "https://support.microsoft.com/en-us/topic/how-to-control-the-rule-actions-to-start-an-application-or-run-a-macro-in-outlook-2016-and-outlook-2013-e4964b72-173c-959d-5d7b-ead562979048", + "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_outlook_enable_unsafe_client_mail_rules.yml" ], "tags": [ @@ -57461,8 +57624,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md", "https://github.com/OTRF/detection-hackathon-apt29/issues/16", + "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_get_clipboard.yml" ], "tags": [ @@ -57529,9 +57692,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/frack113/status/1555830623633375232", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)?redirectedfrom=MSDN", "https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/", - "https://twitter.com/frack113/status/1555830623633375232", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_cli.yml" ], "tags": [ @@ -57654,8 +57817,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "Internal Research", "https://www.sentinelone.com/labs/inside-malicious-windows-apps-for-malware-deployment/", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_systemsettingsadminflows_turn_on_dev_features.yml" ], "tags": [ @@ -57678,13 +57841,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/shantanukhande/status/1229348874298388484", "https://twitter.com/Wietze/status/1542107456507203586", "https://twitter.com/Hexacorn/status/1224848930795552769", + "https://twitter.com/shantanukhande/status/1229348874298388484", "https://twitter.com/pythonresponder/status/1385064506049630211?s=21", "https://github.com/Hackndo/lsassy/blob/14d8f8ae596ecf22b449bfe919829173b8a07635/lsassy/dumpmethod/comsvcs.py", - "https://twitter.com/SBousseaden/status/1167417096374050817", "https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/", + "https://twitter.com/SBousseaden/status/1167417096374050817", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_process_dump_via_comsvcs.yml" ], "tags": [ @@ -57760,8 +57923,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", + "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_user_discovery_get_aduser.yml" ], "tags": [ @@ -57796,10 +57959,10 @@ "logsource.product": "windows", "refs": [ "https://www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/megacortex-ransomware-spotted-attacking-enterprise-networks", - "https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html", - "https://twitter.com/christophetd/status/1164506034720952320", - "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/", "https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html", + "https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html", + "https://threatresearch.ext.hp.com/svcready-a-new-loader-reveals-itself/", + "https://twitter.com/christophetd/status/1164506034720952320", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_binary_highly_relevant.yml" ], "tags": [ @@ -57900,11 +58063,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://labs.f-secure.com/blog/prelude-to-ransomware-systembc", "https://thedfirreport.com/2021/01/18/all-that-for-a-coinminer", + "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", "https://github.com/3CORESec/MAL-CL/tree/master/Descriptors/Other/Advanced%20IP%20Scanner", "https://news.sophos.com/en-us/2019/12/09/snatch-ransomware-reboots-pcs-into-safe-mode-to-bypass-protection/", - "https://labs.f-secure.com/blog/prelude-to-ransomware-systembc", - "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", "https://assets.documentcloud.org/documents/20444693/fbi-pin-egregor-ransomware-bc-01062021.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_advanced_ip_scanner.yml" ], @@ -57946,8 +58109,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/", "https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/", + "https://researchcenter.paloaltonetworks.com/2018/01/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_iis_appcmd_susp_module_install.yml" ], "tags": [ @@ -58020,10 +58183,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52", - "https://twitter.com/eral4m/status/1479080793003671557", "https://twitter.com/Hexacorn/status/885258886428725250", "http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/", + "https://gist.github.com/ryhanson/227229866af52e2d963cf941af135a52", + "https://twitter.com/eral4m/status/1479080793003671557", "https://twitter.com/nas_bench/status/1433344116071583746", "https://twitter.com/eral4m/status/1479106975967240209", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_activity.yml" @@ -58126,9 +58289,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/09/26/bumblebee-round-two/", - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime", "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bumblebee-loader-cybercrime", + "https://thedfirreport.com/2022/09/26/bumblebee-round-two/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wab_unusual_parents.yml" ], "tags": [ @@ -58229,8 +58392,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/_st0pp3r_/status/1560072680887525378", "https://twitter.com/Oddvarmoe/status/993383596244258816", + "https://twitter.com/_st0pp3r_/status/1560072680887525378", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_pester.yml" ], "tags": [ @@ -58409,9 +58572,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html", "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1036.003/T1036.003.md#atomic-test-1---masquerading-as-windows-lsass-process", "https://mgreen27.github.io/posts/2019/05/12/BinaryRename.html", + "https://mgreen27.github.io/posts/2019/05/29/BinaryRename2.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_binary.yml" ], "tags": [ @@ -58638,8 +58801,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5", "https://twitter.com/mrd0x/status/1463526834918854661", + "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml" ], "tags": [ @@ -58674,8 +58837,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/jseerden/status/1247985304667066373/photo/1", - "https://twitter.com/lefterispan/status/1286259016436514816", "https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension", + "https://twitter.com/lefterispan/status/1286259016436514816", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml" ], @@ -58709,11 +58872,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/cyberwar_15/status/1187287262054076416", - "https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1", "https://en.wikipedia.org/wiki/Hangul_(word_processor)", "https://blog.alyac.co.kr/1901", + "https://twitter.com/cyberwar_15/status/1187287262054076416", "https://www.securitynewspaper.com/2016/11/23/technical-teardown-exploit-malware-hwp-files/", + "https://www.hybrid-analysis.com/search?query=context:74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5&from_sample=5db135000388385a7644131f&block_redirect=1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hwp_exploits.yml" ], "tags": [ @@ -58898,8 +59061,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/sblmsrsn/status/1445758411803480072?s=20", - "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2", "https://lolbas-project.github.io/lolbas/Binaries/Certoc/", + "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml" ], "tags": [ @@ -58955,9 +59118,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/", "https://twitter.com/nas_bench/status/1534957360032120833", "https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html", - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_cdb.yml" ], "tags": [ @@ -59041,8 +59204,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/cw1997/NATBypass", "https://github.com/HiwinCN/HTran", + "https://github.com/cw1997/NATBypass", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_htran_or_natbypass.yml" ], "tags": [ @@ -59076,9 +59239,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.nirsoft.net/utils/nircmd2.html#using", - "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", "https://www.nirsoft.net/utils/nircmd.html", + "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", + "https://www.nirsoft.net/utils/nircmd2.html#using", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_nircmd.yml" ], "tags": [ @@ -59244,8 +59407,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains", "https://github.com/redcanaryco/atomic-red-team/blob/d0dad62dbcae9c60c519368e82c196a3db577055/atomics/T1124/T1124.md", + "https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_w32tm.yml" ], "tags": [ @@ -59278,8 +59441,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1674399582162153472", "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/", + "https://twitter.com/0gtweet/status/1674399582162153472", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml" ], "tags": [ @@ -59378,8 +59541,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D", "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/erase", + "https://www.joesandbox.com/analysis/509330/0/html#1044F3BDBE3BB6F734E357235F4D5898582D", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_del_greedy_deletion.yml" ], "tags": [ @@ -59412,9 +59575,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/", "https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/", "https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html", + "https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_driverquery_recon.yml" ], "tags": [ @@ -59438,9 +59601,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/", "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/", "https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/", - "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_net_groups_and_accounts_recon.yml" ], "tags": [ @@ -59723,9 +59886,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/", "http://hyp3rlinx.altervista.org/advisories/Windows_TCPIP_Finger_Command_C2_Channel_and_Bypassing_Security_Software.txt", "https://twitter.com/bigmacjpg/status/1349727699863011328?s=12", + "https://app.any.run/tasks/40115012-a919-4208-bfed-41e82cb3dadf/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_finger_usage.yml" ], "tags": [ @@ -59826,8 +59989,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/nao_sec/status/1530196847679401984", - "https://twitter.com/_JohnHammond/status/1531672601067675648", "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/", + "https://twitter.com/_JohnHammond/status/1531672601067675648", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msdt_arbitrary_command_execution.yml" ], "tags": [ @@ -60206,13 +60369,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects", "https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/", + "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md", + "https://www.joeware.net/freetools/tools/adfind/", "https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx", "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/", "https://thedfirreport.com/2020/05/08/adfind-recon/", - "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1087.002/T1087.002.md#atomic-test-7---adfind---enumerate-active-directory-user-objects", - "https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md", - "https://www.joeware.net/freetools/tools/adfind/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_adfind_susp_usage.yml" ], "tags": [ @@ -60269,8 +60432,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/carlospolop/PEASS-ng", "https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation", + "https://github.com/carlospolop/PEASS-ng", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_winpeas.yml" ], "tags": [ @@ -60319,8 +60482,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/", "https://docs.microsoft.com/en-us/powershell/module/pki/import-certificate?view=windowsserver2022-ps", + "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_import_cert_susp_locations.yml" ], "tags": [ @@ -60422,8 +60585,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "Internal Research", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks", + "Internal Research", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_change.yml" ], "tags": [ @@ -60456,10 +60619,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing", - "https://pentestlab.blog/2020/02/24/parent-pid-spoofing/", - "https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files", "https://www.picussecurity.com/resource/blog/how-to-detect-parent-pid-ppid-spoofing-attacks", + "https://pentestlab.blog/2020/02/24/parent-pid-spoofing/", + "https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing", + "https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_selectmyparent.yml" ], "tags": [ @@ -60492,9 +60655,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/", "https://www.winhelponline.com/blog/enable-and-disable-windows-firewall-quickly-using-command-line/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-1---disable-microsoft-defender-firewall", - "https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_fw_disable.yml" ], "tags": [ @@ -60645,8 +60808,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task", "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-8---windows---disable-the-sr-scheduled-task", "https://twitter.com/MichalKoczwara/status/1553634816016498688", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_disable.yml" ], @@ -60781,8 +60944,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content", "https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell", + "https://www.virustotal.com/gui/file/af1c82237b6e5a3a7cdbad82cc498d298c67845d92971bada450023d1335e267/content", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_add_windows_capability.yml" ], "tags": [ @@ -60840,8 +61003,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/PhilipTsukerman/status/992021361106268161", "https://lolbas-project.github.io/lolbas/Binaries/Register-cimprovider/", + "https://twitter.com/PhilipTsukerman/status/992021361106268161", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_cimprovider_dll_load.yml" ], "tags": [ @@ -60874,8 +61037,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html", "https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core", + "https://cocomelonc.github.io/persistence/2022/12/09/malware-pers-20.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_userinit_uncommon_child_processes.yml" ], "tags": [ @@ -60908,10 +61071,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/", - "https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/", "https://support.microsoft.com/fr-fr/topic/an-ms-dos-based-program-that-uses-the-ms-dos-protected-mode-interface-crashes-on-a-computer-that-is-running-windows-7-5dc739ea-987b-b458-15e4-d28d5cca63c7", + "https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/", "https://docs.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support", + "https://app.any.run/tasks/93fe92fa-8b2b-4d92-8c09-a841aed2e793/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_16bit_application.yml" ], "tags": [ @@ -61002,8 +61165,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/", "https://www.slideshare.net/heirhabarov/hunting-for-credentials-dumping-in-windows-environment", + "https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/", "https://dfironthemountain.wordpress.com/2018/12/06/locked-file-access-using-esentutl-exe/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_esentutl_sensitive_file_copy.yml" ], @@ -61049,8 +61212,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://strontic.github.io/xcyclopedia/library/pnputil.exe-60EDC5E6BDBAEE441F2E3AEACD0340D2.html", "https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax", + "https://strontic.github.io/xcyclopedia/library/pnputil.exe-60EDC5E6BDBAEE441F2E3AEACD0340D2.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_driver_installed_by_pnputil.yml" ], "tags": [ @@ -61217,9 +61380,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/", "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html", - "https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_exec_susp_locations.yml" ], "tags": [ @@ -61286,6 +61449,43 @@ "uuid": "4782eb5a-a513-4523-a0ac-f3082b26ac5c", "value": "Mshtml DLL RunHTMLApplication Abuse" }, + { + "description": "Detects command line containing reference to the \"::$index_allocation\" stream, which can be used as a technique to prevent access to folders or files from tooling such as \"explorer.exe\" or \"powershell.exe\"\n", + "meta": { + "author": "Nasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl)", + "creation_date": "2023/10/09", + "falsepositive": [ + "Unlikely" + ], + "filename": "proc_creation_win_susp_hidden_dir_index_allocation.yml", + "level": "medium", + "logsource.category": "process_creation", + "logsource.product": "windows", + "refs": [ + "https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1551-4d3a-a0ea-4fa40f848eb3", + "https://sec-consult.com/blog/detail/pentesters-windows-ntfs-tricks-collection/", + "https://twitter.com/pfiatde/status/1681977680688738305", + "https://github.com/redcanaryco/atomic-red-team/blob/5c3b23002d2bbede3c07e7307165fc2a235a427d/atomics/T1564.004/T1564.004.md#atomic-test-5---create-hidden-directory-via-index_allocation", + "https://soroush.me/blog/2010/12/a-dotty-salty-directory-a-secret-place-in-ntfs-for-secret-files/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_hidden_dir_index_allocation.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1564.004" + ] + }, + "related": [ + { + "dest-uuid": "f2857333-11d4-45bf-b064-2c28d8525be5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "0900463c-b33b-49a8-be1d-552a3b553dae", + "value": "Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI" + }, { "description": "Detects successful code compilation via Visual Basic Command Line Compiler that utilizes Windows Resource to Object Converter.", "meta": { @@ -61441,10 +61641,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", - "https://twitter.com/egre55/status/1087685529016193025", "https://lolbas-project.github.io/lolbas/Binaries/Certutil/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", "https://forensicitguy.github.io/agenttesla-vba-certutil-download/", + "https://twitter.com/egre55/status/1087685529016193025", "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_download_file_sharing_domains.yml" ], @@ -61531,6 +61731,41 @@ "uuid": "a642964e-bead-4bed-8910-1bb4d63e3b4d", "value": "HackTool - Mimikatz Execution" }, + { + "description": "Detects the use of CoercedPotato, a tool for privilege escalation", + "meta": { + "author": "Florian Roth (Nextron Systems)", + "creation_date": "2023/10/11", + "falsepositive": [ + "Unknown" + ], + "filename": "proc_creation_win_hktl_coercedpotato.yml", + "level": "high", + "logsource.category": "process_creation", + "logsource.product": "windows", + "refs": [ + "https://github.com/hackvens/CoercedPotato", + "https://blog.hackvens.fr/articles/CoercedPotato.html", + "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_coercedpotato.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.privilege_escalation", + "attack.t1055" + ] + }, + "related": [ + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "e8d34729-86a4-4140-adfd-0a29c2106307", + "value": "HackTool - CoercedPotato Execution" + }, { "description": "Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0", "meta": { @@ -61544,8 +61779,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#bypass-or-avoid-amsi-by-version-downgrade-", "http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/", + "https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#bypass-or-avoid-amsi-by-version-downgrade-", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml" ], "tags": [ @@ -61679,9 +61914,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a", "https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html", "https://docs.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate", - "https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_export_certificate.yml" ], "tags": [ @@ -61815,9 +62050,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html", "https://guides.lib.umich.edu/c.php?g=282942&p=1885348", "https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/", - "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_extensions.yml" ], "tags": [ @@ -61953,8 +62188,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1359039665232306183?s=21", "https://ss64.com/nt/logman.html", + "https://twitter.com/0gtweet/status/1359039665232306183?s=21", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_logman_disable_eventlog.yml" ], "tags": [ @@ -61996,9 +62231,9 @@ "logsource.product": "windows", "refs": [ "https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/", + "https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html", "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/", "https://www.mandiant.com/resources/unc2165-shifts-to-evade-sanctions", - "https://www.trendmicro.com/en_us/research/23/a/vice-society-ransomware-group-targets-manufacturing-companies.html", "https://twitter.com/cglyer/status/1355171195654709249", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_uninstall_security_products.yml" ], @@ -62032,8 +62267,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1123/T1123.md", + "https://eqllib.readthedocs.io/en/latest/analytics/ab7a6ef4-0983-4275-a4f1-5c6bd3c31c23.html", "https://github.com/frgnca/AudioDeviceCmdlets", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_audio_capture.yml" ], @@ -62067,9 +62302,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", - "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf", "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", + "https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf", + "https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_computer_discovery_get_adcomputer.yml" ], "tags": [ @@ -62102,9 +62337,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", "https://www.rapid7.com/blog/post/2022/01/18/active-exploitation-of-vmware-horizon-servers/", "https://nodejs.org/api/cli.html", - "http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html", "https://www.sprocketsecurity.com/resources/crossing-the-log4j-horizon-a-vulnerability-with-no-return", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_node_abuse.yml" ], @@ -62138,9 +62373,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b", "https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf", "https://github.com/hfiref0x/UACME", - "https://mattharr0ey.medium.com/privilege-escalation-uac-bypass-in-changepk-c40b92818d1b", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_changepk_slui.yml" ], "tags": [ @@ -62207,8 +62442,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior", "https://www.cybereason.com/blog/cybereason-vs.-blackcat-ransomware", + "https://docs.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation.yml" ], "tags": [ @@ -62274,8 +62509,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell", + "https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_shadowcopy_deletion.yml" ], "tags": [ @@ -62447,13 +62682,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/", - "https://lolbas-project.github.io/lolbas/Binaries/Msedge/", - "https://taggart-tech.com/quasar-electron/", - "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf", - "https://lolbas-project.github.io/lolbas/Binaries/Teams/", - "https://github.com/mttaggart/quasar", "https://positive.security/blog/ms-officecmd-rce", + "https://github.com/mttaggart/quasar", + "https://lolbas-project.github.io/lolbas/Binaries/Teams/", + "https://taggart-tech.com/quasar-electron/", + "https://lolbas-project.github.io/lolbas/Binaries/msedgewebview2/", + "https://medium.com/@MalFuzzer/one-electron-to-rule-them-all-dc2e9b263daf", + "https://lolbas-project.github.io/lolbas/Binaries/Msedge/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_electron_app_children.yml" ], "tags": [ @@ -62552,9 +62787,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "http://www.xuetr.com/", "https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/", "https://www.crowdstrike.com/blog/falcon-overwatch-report-finds-increase-in-ecrime/", - "http://www.xuetr.com/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml" ], "tags": [ @@ -62870,8 +63105,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/", "https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/", + "https://s3cur3th1ssh1t.github.io/Bypass_AMSI_by_manual_modification/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_amsi_init_failed_bypass.yml" ], "tags": [ @@ -62904,9 +63139,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/", "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1562.001/T1562.001.md", "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1112/T1112.md", - "https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_susp_paths.yml" ], "tags": [ @@ -62947,9 +63182,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/", "https://twitter.com/pabraeken/status/990758590020452353", + "https://docs.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml" ], "tags": [ @@ -63122,8 +63357,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/", "https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/", + "https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_cobaltstrike_process_patterns.yml" ], "tags": [ @@ -63179,9 +63414,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/", "https://thedfirreport.com/2023/01/09/unwrapping-ursnifs-gifts/", "https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html", + "https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_driverquery_usage.yml" ], "tags": [ @@ -63204,10 +63439,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.pureid.io/dumping-abusing-windows-credentials-part-1/", "https://twitter.com/0gtweet/status/1299071304805560321?s=21", - "https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/", + "https://www.pureid.io/dumping-abusing-windows-credentials-part-1/", "https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/", + "https://lolbas-project.github.io/lolbas/Binaries/Rdrleakdiag/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rdrleakdiag_process_dumping.yml" ], "tags": [ @@ -63240,10 +63475,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", - "https://isc.sans.edu/diary/22264", "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/", + "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", + "https://isc.sans.edu/diary/22264", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_direct_ip.yml" ], "tags": [ @@ -63309,9 +63544,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/", "https://en.wikipedia.org/wiki/HTML_Application", "https://www.echotrail.io/insights/search/mshta.exe", + "https://app.any.run/tasks/34221348-072d-4b70-93f3-aa71f6ebecad/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mshta_susp_pattern.yml" ], "tags": [ @@ -63346,8 +63581,8 @@ "refs": [ "https://www.virustotal.com/gui/file/427616528b7dbc4a6057ac89eb174a3a90f7abcf3f34e5a359b7a910d82f7a72/behavior", "https://www.virustotal.com/gui/file/35c22725a92d5cb1016b09421c0a6cdbfd860fd4778b3313669b057d4a131cb7/behavior", - "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior", "https://www.virustotal.com/gui/file/4abe1395a09fda06d897a9c4eb247278c1b6cddda5d126ce5b3f4f499e3b8fa2/behavior", + "https://www.virustotal.com/gui/file/34de4c8beded481a4084a1fd77855c3e977e8ac643e5c5842d0f15f7f9b9086f/behavior", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_encode_susp_extensions.yml" ], "tags": [ @@ -63382,11 +63617,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe", - "https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/", "https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf", "https://twitter.com/gN3mes1s/status/1206874118282448897", "https://securityboulevard.com/2019/08/agent-tesla-evading-edr-by-removing-api-hooks/", + "https://app.any.run/tasks/c6993447-d1d8-414e-b856-675325e5aa09/", + "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1027.004/T1027.004.md#atomic-test-1---compile-after-delivery-using-cscexe", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_csc_susp_dynamic_compilation.yml" ], "tags": [ @@ -63461,8 +63696,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/eral4m/status/1451112385041911809", "https://strontic.github.io/xcyclopedia/library/stordiag.exe-1F08FC87C373673944F6A7E8B18CD845.html", + "https://twitter.com/eral4m/status/1451112385041911809", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml" ], "tags": [ @@ -63495,9 +63730,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.nirsoft.net/utils/nircmd2.html#using", - "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", "https://www.nirsoft.net/utils/nircmd.html", + "https://www.winhelponline.com/blog/run-program-as-system-localsystem-account-windows/", + "https://www.nirsoft.net/utils/nircmd2.html#using", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_nircmd_as_system.yml" ], "tags": [ @@ -63720,8 +63955,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md", "https://eqllib.readthedocs.io/en/latest/analytics/e491ce22-792f-11e9-8f5c-d46d6d62a49e.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1548.002/T1548.002.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_fodhelper.yml" ], "tags": [ @@ -63754,8 +63989,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/", + "https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_dnx.yml" ], "tags": [ @@ -63854,8 +64089,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html", "https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/", + "https://cocomelonc.github.io/malware/2022/11/02/malware-pers-18.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_werfault_reflect_debugger_exec.yml" ], "tags": [ @@ -64023,11 +64258,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file", "https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464", - "https://twitter.com/max_mal_/status/1542461200797163522", - "https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/", "https://github.com/pr0xylife/Qakbot/blob/4f0795d79dabee5bc9dd69f17a626b48852e7869/Qakbot_AA_23.06.2022.txt", + "https://github.com/redcanaryco/atomic-red-team/blob/0f229c0e42bfe7ca736a14023836d65baa941ed2/atomics/T1105/T1105.md#atomic-test-18---curl-download-file", + "https://www.volexity.com/blog/2022/07/28/sharptongue-deploys-clever-mail-stealing-browser-extension-sharpext/", + "https://twitter.com/max_mal_/status/1542461200797163522", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_susp_download.yml" ], "tags": [ @@ -64093,13 +64328,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/", - "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware", - "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/", - "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", - "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow", - "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4", "https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf", + "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", + "https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/", + "https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4", + "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow", + "https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware", + "https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml" ], "tags": [ @@ -64242,9 +64477,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/", "https://www.intrinsec.com/apt27-analysis/", - "https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml" ], "tags": [ @@ -64436,8 +64671,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/", "https://lolbas-project.github.io/lolbas/Binaries/Verclsid/", + "https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/", "https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml" ], @@ -64472,8 +64707,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/mrd0x/status/1461041276514623491", - "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/", "https://twitter.com/tccontre18/status/1480950986650832903", + "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_http_ip_pattern.yml" ], "tags": [ @@ -64506,8 +64741,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md", "https://www.hybrid-analysis.com/sample/4be06ecd234e2110bd615649fe4a6fa95403979acf889d7e45a78985eb50acf9?environmentId=1", + "https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc77e06100e20ec29/Ransomware/Maze.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_product_class.yml" ], "tags": [ @@ -64541,10 +64776,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/", - "https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191", - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Winword/", + "https://medium.com/@reegun/unsanitized-file-validation-leads-to-malicious-payload-download-via-office-binaries-202d02db7191", + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Powerpnt/", + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Excel/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_arbitrary_cli_download.yml" ], "tags": [ @@ -64653,9 +64888,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/frack113/status/1555830623633375232", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)?redirectedfrom=MSDN", "https://www.acunetix.com/blog/articles/windows-short-8-3-filenames-web-security-problem/", - "https://twitter.com/frack113/status/1555830623633375232", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntfs_short_name_path_use_image.yml" ], "tags": [ @@ -64689,11 +64924,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md", - "https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt", - "https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md", - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn", "https://eqllib.readthedocs.io/en/latest/analytics/c91f422a-5214-4b17-8664-c5fcf115c0a2.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070/T1070.md", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn", + "https://github.com/albertzsigovits/malware-notes/blob/558898932c1579ff589290092a2c8febefc3a4c9/Ransomware/Lockbit.md", + "https://blog.cluster25.duskrise.com/2023/05/22/back-in-black-blackbyte-nt", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml" ], "tags": [ @@ -64835,8 +65070,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md", "https://docs.microsoft.com/en-us/sysinternals/downloads/sdelete", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_sdelete.yml" ], "tags": [ @@ -64927,9 +65162,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://github.com/cloudflare/cloudflared", "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps", "https://blog.reconinfosec.com/emergence-of-akira-ransomware-group", - "https://github.com/cloudflare/cloudflared", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cloudflared_tunnel_run.yml" ], "tags": [ @@ -64980,10 +65215,10 @@ "refs": [ "https://twitter.com/JohnLaTwC/status/835149808817991680", "https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/", - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", "https://lolbas-project.github.io/lolbas/Binaries/Certutil/", - "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", "https://learn.microsoft.com/en-us/archive/blogs/pki/basic-crl-checking-with-certutil", + "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_decode.yml" ], "tags": [ @@ -65017,9 +65252,9 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/Cyb3rWard0g/status/1453123054243024897", - "https://github.com/antonioCoco/RogueWinRM", - "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/", "https://speakerdeck.com/heirhabarov/hunting-for-privilege-escalation-in-windows-environment", + "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/", + "https://github.com/antonioCoco/RogueWinRM", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_child_process_as_system_.yml" ], "tags": [ @@ -65052,8 +65287,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://o365blog.com/aadinternals/", "https://github.com/Gerenios/AADInternals", + "https://o365blog.com/aadinternals/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_aadinternals_cmdlets_execution.yml" ], "tags": [ @@ -65114,9 +65349,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6", "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html", "https://www.ired.team/offensive-security/lateral-movement/t1076-rdp-hijacking-for-lateral-movement", + "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_tscon_localsystem.yml" ], "tags": [ @@ -65149,8 +65384,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect", "https://twitter.com/bohops/status/1635288066909966338", + "https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_dotnet_dump.yml" ], "tags": [ @@ -65183,8 +65418,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/", "https://docs.microsoft.com/en-us/azure/dns/dns-zones-records", + "https://lolbas-project.github.io/lolbas/Binaries/Dnscmd/", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dnscmd_discovery.yml" ], @@ -65295,8 +65530,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://github.com/malcomvetter/CSExec", + "https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_csexec.yml" ], "tags": [ @@ -65411,8 +65646,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/nas_bench/status/1535431474429808642", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/", + "https://twitter.com/nas_bench/status/1535431474429808642", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml" ], "tags": [ @@ -65454,8 +65689,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/", + "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file.yml" ], "tags": [ @@ -65624,8 +65859,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://learn.microsoft.com/en-us/windows/package-manager/winget/source", + "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winget_add_susp_custom_source.yml" ], "tags": [ @@ -65659,8 +65894,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/", "https://lolbas-project.github.io/lolbas/Binaries/Atbroker/", + "http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_atbroker.yml" ], "tags": [ @@ -65693,9 +65928,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html", - "https://github.com/fireeye/DueDLLigence", "https://lolbas-project.github.io/lolbas/Binaries/Rasautou/", + "https://github.com/fireeye/DueDLLigence", + "https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml" ], "tags": [ @@ -65947,8 +66182,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/", + "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_whoami_execution.yml" ], "tags": [ @@ -66015,8 +66250,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/OTRF/detection-hackathon-apt29/issues/6", "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md", + "https://github.com/OTRF/detection-hackathon-apt29/issues/6", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sdclt_child_process.yml" ], "tags": [ @@ -66107,10 +66342,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html", "https://atomicredteam.io/defense-evasion/T1220/", - "https://lolbas-project.github.io/lolbas/Binaries/Wmic/", + "https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html", "https://twitter.com/mattifestation/status/986280382042595328", + "https://lolbas-project.github.io/lolbas/Binaries/Wmic/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_squiblytwo_bypass.yml" ], "tags": [ @@ -66235,8 +66470,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/", "https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/", + "https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml" ], "tags": [ @@ -66292,10 +66527,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1", "https://twitter.com/JohnLaTwC/status/1415295021041979392", - "https://bidouillesecurity.com/disable-windows-defender-in-powershell/", "https://vms.drweb.fr/virus/?i=24144899", + "https://github.com/gordonbay/Windows-On-Reins/blob/e587ac7a0407847865926d575e3c46f68cf7c68d/wor.ps1", + "https://bidouillesecurity.com/disable-windows-defender-in-powershell/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_disable_sec_services.yml" ], "tags": [ @@ -66328,8 +66563,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf", "https://sourceforge.net/projects/mouselock/", + "https://github.com/klsecservices/Publications/blob/657deb6a6eb6e00669afd40173f425fb49682eaa/Incident-Response-Analyst-Report-2020.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_mouselock_execution.yml" ], "tags": [ @@ -66457,8 +66692,8 @@ "logsource.product": "windows", "refs": [ "https://thedfirreport.com/2022/09/26/bumblebee-round-two/", - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments", "https://www.microsoft.com/en-us/security/blog/2022/10/25/dev-0832-vice-society-opportunistic-ransomware-campaigns-impacting-us-education-sector/", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/espionage-asia-governments", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_weak_or_abused_passwords.yml" ], "tags": [ @@ -66483,8 +66718,8 @@ "logsource.product": "windows", "refs": [ "https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html", - "https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf", "https://learn.microsoft.com/en-us/archive/blogs/jonathantrull/detecting-sticky-key-backdoors", + "https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign-v1.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_sticky_keys_replace.yml" ], "tags": [ @@ -66690,8 +66925,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html", "https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/", + "https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_plink.yml" ], "tags": [ @@ -66854,10 +67089,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/Alh4zr3d/status/1580925761996828672", "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/", - "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/", "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html", + "https://twitter.com/Alh4zr3d/status/1580925761996828672", + "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_sdset_hide_sevices.yml" ], "tags": [ @@ -66892,10 +67127,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses", - "https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt", - "https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md", "https://www.crowdstrike.com/resources/reports/2019-crowdstrike-global-threat-report/", + "https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses", + "https://github.com/ThreatHuntingProject/ThreatHunting/blob/cb22598bb70651f88e0285abc8d835757d2cb596/hunts/suspicious_process_creation_via_windows_event_logs.md", + "https://github.com/mbevilacqua/appcompatprocessor/blob/6c847937c5a836e2ce2fe2b915f213c345a3c389/AppCompatSearch.txt", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_execution_path.yml" ], "tags": [ @@ -66962,12 +67197,12 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://github.com/CCob/MirrorDump", + "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/", + "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf", + "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml", "https://github.com/helpsystems/nanodump", "https://github.com/Hackndo/lsassy", - "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/credential_access_lsass_memdump_file_created.toml", - "https://github.com/CCob/MirrorDump", - "https://medium.com/@markmotig/some-ways-to-dump-lsass-exe-c4a75fdc49bf", - "https://www.whiteoaksecurity.com/blog/attacks-defenses-dumping-lsass-no-mimikatz/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_lsass_dmp_cli_keywords.yml" ], "tags": [ @@ -67143,9 +67378,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/", "https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120", "https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html", + "https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir.yml" ], "tags": [ @@ -67178,10 +67413,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178", - "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64", - "https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165", "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191", + "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64", + "https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178", + "https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml" ], "tags": [ @@ -67247,8 +67482,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/", + "https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/", "https://twitter.com/_felamos/status/1204705548668555264", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_dotnet.yml" ], @@ -67351,8 +67586,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md", "https://github.com/harleyQu1nn/AggressorScripts", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_software_discovery.yml" ], "tags": [ @@ -67471,8 +67706,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/jseerden/status/1247985304667066373/photo/1", - "https://twitter.com/lefterispan/status/1286259016436514816", "https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension", + "https://twitter.com/lefterispan/status/1286259016436514816", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml" ], @@ -67573,10 +67808,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md", - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult", "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf", "https://unit42.paloaltonetworks.com/emissary-trojan-changelog-did-operation-lotus-blossom-cause-it-to-evolve/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpresult_execution.yml" ], "tags": [ @@ -67789,9 +68024,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340", - "https://twitter.com/bohops/status/1477717351017680899?s=12", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/AccCheckConsole/", + "https://twitter.com/bohops/status/1477717351017680899?s=12", + "https://gist.github.com/bohops/2444129419c8acf837aedda5f0e7f340", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_acccheckconsole.yml" ], "tags": [ @@ -67814,9 +68049,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1564968845726580736", "https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html", "https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)", + "https://twitter.com/0gtweet/status/1564968845726580736", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml" ], "tags": [ @@ -67858,17 +68093,17 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml", - "https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html", - "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", - "https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100", - "https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml", - "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e", "https://www.vmray.com/analyses/2d2fa29185ad/report/overview.html", + "https://github.com/splunk/security_content/blob/develop/detections/endpoint/office_spawning_control.yml", "https://twitter.com/andythevariable/status/1576953781581144064?s=20&t=QiJILvK4ZiBdR8RJe24u-A", - "https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/", - "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml", + "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/windows/defense_evasion_execution_msbuild_started_by_office_app.toml", + "https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/", + "https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html", "https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set", + "https://app.any.run/tasks/c903e9c8-0350-440c-8688-3881b556b8e0/", + "https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100", + "https://github.com/vadim-hunter/Detection-Ideas-Rules/blob/02bcbfc2bfb8b4da601bb30de0344ae453aa1afe/Threat%20Intelligence/The%20DFIR%20Report/20210329_Sodinokibi_(aka_REvil)_Ransomware.yaml", + "https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_susp_child_processes.yml" ], "tags": [ @@ -68055,11 +68290,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar", - "https://nwgat.ninja/getting-system-information-with-wmic-on-windows/", "https://github.com/redcanaryco/atomic-red-team/blob/a2ccd19c37d0278b4ffa8583add3cf52060a5418/atomics/T1082/T1082.md#atomic-test-25---system-information-discovery-with-wmic", - "https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/", + "https://blog.sekoia.io/aurora-a-rising-stealer-flying-under-the-radar", "https://app.any.run/tasks/a6aa0057-82ec-451f-8f99-55650ca537da/", + "https://nwgat.ninja/getting-system-information-with-wmic-on-windows/", + "https://blog.cyble.com/2023/01/18/aurora-a-stealer-using-shapeshifting-tactics/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_recon_system_info_discovery.yml" ], "tags": [ @@ -68160,8 +68395,8 @@ "logsource.product": "windows", "refs": [ "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/", - "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/", "https://learn.microsoft.com/en-us/windows/win32/secauthz/sid-strings", + "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_sdset_deny_service_access.yml" ], "tags": [ @@ -68194,8 +68429,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/vysecurity/status/977198418354491392", "https://github.com/vysecurity/Aggressor-VYSEC/blob/0d61c80387b9432dab64b8b8a9fb52d20cfef80e/ping.cna", + "https://twitter.com/vysecurity/status/977198418354491392", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ping_hex_ip.yml" ], "tags": [ @@ -68278,10 +68513,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control", - "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", + "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/", + "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_response_file.yml" ], "tags": [ @@ -68314,10 +68549,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire", - "https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes", "https://pentestlab.blog/2017/04/13/hot-potato/", "https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/", + "https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes", + "https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire", "https://github.com/ohpe/juicy-potato", "https://www.localpotato.com/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_relay_attacks_tools.yml" @@ -68426,8 +68661,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w", "https://www.autoitscript.com/site/", + "https://twitter.com/malmoeb/status/1665463817130725378?s=12&t=C0_T_re0wRP_NfKa27Xw9w", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_autoit.yml" ], "tags": [ @@ -68460,11 +68695,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/Alh4zr3d/status/1580925761996828672", + "https://twitter.com/0gtweet/status/1628720819537936386", "https://itconnect.uw.edu/tools-services-support/it-systems-infrastructure/msinf/other-help/understanding-sddl-syntax/", "https://blog.talosintelligence.com/2021/10/threat-hunting-in-large-datasets-by.html", - "https://twitter.com/0gtweet/status/1628720819537936386", "https://www.sans.org/blog/red-team-tactics-hiding-windows-services/", + "https://twitter.com/Alh4zr3d/status/1580925761996828672", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sc_sdset_modification.yml" ], "tags": [ @@ -68659,8 +68894,8 @@ "https://docs.microsoft.com/en-us/dotnet/standard/data/xml/xslt-stylesheet-scripting-using-msxsl-script", "https://0x00sec.org/t/clientside-exploitation-in-2018-how-pentesting-has-changed/7356", "http://blog.sevagas.com/?Hacking-around-HTA-files", - "https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997", "https://twitter.com/mattifestation/status/1326228491302563846", + "https://medium.com/tsscyber/pentesting-and-hta-bypassing-powershell-constrained-language-mode-53a42856c997", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mshta_susp_execution.yml" ], "tags": [ @@ -68804,8 +69039,8 @@ "logsource.product": "windows", "refs": [ "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=42", - "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115", "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=41", + "https://learn.microsoft.com/en-us/dotnet/api/microsoft.hpc.scheduler.store.cx509enrollmentwebclassfactoryclass?view=hpc-sdk-5.1.6115", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_x509enrollment.yml" ], "tags": [ @@ -68905,8 +69140,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://persistence-info.github.io/Data/wpbbin.html", "https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c", + "https://persistence-info.github.io/Data/wpbbin.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wpbbin_potential_persistence.yml" ], "tags": [ @@ -69007,8 +69242,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html", "https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options", + "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powercfg_execution.yml" ], "tags": [ @@ -69068,8 +69303,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://eqllib.readthedocs.io/en/latest/analytics/014c3f51-89c6-40f1-ac9c-5688f26090ab.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md", + "https://eqllib.readthedocs.io/en/latest/analytics/014c3f51-89c6-40f1-ac9c-5688f26090ab.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_net_user_add.yml" ], "tags": [ @@ -69102,8 +69337,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/", "https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/", + "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_paths.yml" ], "tags": [ @@ -69137,8 +69372,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/0gtweet/status/1602644163824156672?s=20&t=kuxbUnZPltpvFPZdCrqPXA", - "https://twitter.com/pabraeken/status/990717080805789697", "https://lolbas-project.github.io/lolbas/Binaries/Runonce/", + "https://twitter.com/pabraeken/status/990717080805789697", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_runonce_execution.yml" ], "tags": [ @@ -69171,9 +69406,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets", "https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets", + "https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_encode.yml" ], "tags": [ @@ -69272,9 +69507,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://www.poweradmin.com/paexec/", "https://docs.microsoft.com/en-us/sysinternals/downloads/psexec", - "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_remote_execution.yml" ], "tags": [ @@ -69502,8 +69737,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/quarkslab/quarkspwdump", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east", + "https://github.com/quarkslab/quarkspwdump", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_quarks_pwdump.yml" ], "tags": [ @@ -69949,9 +70184,9 @@ "logsource.product": "windows", "refs": [ "https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules", - "https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/", - "https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/", + "https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad", + "https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml" ], "tags": [ @@ -69984,8 +70219,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules", "https://ss64.com/nt/netsh.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md#atomic-test-2---list-windows-firewall-rules", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_fw_rules_discovery.yml" ], "tags": [ @@ -70018,8 +70253,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/cube0x0", "https://www.virustotal.com/gui/search/metadata%253ACube0x0/files", + "https://github.com/cube0x0", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_execution_via_pe_metadata.yml" ], "tags": [ @@ -70159,8 +70394,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://www.trendmicro.com/en_us/research/17/h/backdoor-carrying-emails-set-sights-on-russian-speaking-businesses.html", + "https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16", "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_register_dll_regsvr_susp.yml" ], @@ -70194,9 +70429,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html", - "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49", "https://github.com/sensepost/ruler", + "https://speakerdeck.com/heirhabarov/hunting-for-persistence-via-microsoft-exchange-server-or-outlook?slide=49", + "https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes_remote.yml" ], "tags": [ @@ -70237,10 +70472,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/", "https://www.microsoft.com/en-us/security/blog/wp-content/uploads/2023/03/Figure-7-sample-webdav-process-create-event.png", "https://www.pwndefend.com/2023/03/15/the-long-game-persistent-hash-theft/", "https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/", - "https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/", "https://twitter.com/aceresponder/status/1636116096506818562", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_webdav_client_susp_execution.yml" ], @@ -70275,8 +70510,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/nas_bench/status/1618021838407495681", "https://twitter.com/nas_bench/status/1618021415852335105", + "https://twitter.com/nas_bench/status/1618021838407495681", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml" ], "tags": [ @@ -70463,8 +70698,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/vysecurity/status/974806438316072960", "https://lolbas-project.github.io/lolbas/Binaries/Rpcping/", + "https://twitter.com/vysecurity/status/974806438316072960", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh875578(v=ws.11)", "https://twitter.com/vysecurity/status/873181705024266241", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rpcping_credential_capture.yml" @@ -70574,8 +70809,8 @@ "logsource.product": "windows", "refs": [ "https://rvsec0n.wordpress.com/2020/01/24/malwares-that-bypass-windows-defender/", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_disable_defender_av_security_monitoring.yml" ], "tags": [ @@ -70641,9 +70876,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1", - "https://github.com/tevora-threat/SharpView/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-4---system-discovery-using-sharpview", + "https://github.com/tevora-threat/SharpView/", + "https://github.com/PowerShellMafia/PowerSploit/blob/dev/Recon/PowerView.ps1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_sharpview.yml" ], "tags": [ @@ -70708,9 +70943,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/", "https://medium.com/falconforce/falconfriday-detecting-uac-bypasses-0xff16-86c2a9107abf", "https://github.com/hfiref0x/UACME", - "https://lolbas-project.github.io/lolbas/Binaries/Wsreset/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_wsreset_integrity_level.yml" ], "tags": [ @@ -70777,8 +71012,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wmic", + "https://securelist.com/moonbounce-the-dark-side-of-uefi-firmware/105468/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_remote_execution.yml" ], "tags": [ @@ -70853,9 +71088,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/", "https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md", + "https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_workflow_compiler.yml" ], "tags": [ @@ -70930,9 +71165,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.revshells.com/", "https://nmap.org/ncat/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md", - "https://www.revshells.com/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_netcat.yml" ], "tags": [ @@ -70965,10 +71200,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", - "https://twitter.com/egre55/status/1087685529016193025", "https://lolbas-project.github.io/lolbas/Binaries/Certutil/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/certutil", "https://forensicitguy.github.io/agenttesla-vba-certutil-download/", + "https://twitter.com/egre55/status/1087685529016193025", "https://news.sophos.com/en-us/2021/04/13/compromised-exchange-server-hosting-cryptojacker-targeting-other-exchange-servers/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_certutil_download.yml" ], @@ -71002,8 +71237,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1082/T1082.md#atomic-test-1---system-information-discovery", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_systeminfo_execution.yml" ], "tags": [ @@ -71036,8 +71271,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1482/T1482.md", + "https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb?gi=41b97a644843", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_dsquery_domain_trust_discovery.yml" ], "tags": [ @@ -71071,8 +71306,8 @@ "logsource.product": "windows", "refs": [ "https://ss64.com/nt/for.html", - "https://ss64.com/ps/foreach-object.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md", + "https://ss64.com/ps/foreach-object.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop.yml" ], "tags": [ @@ -71137,8 +71372,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.005/T1218.005.md", "https://eqllib.readthedocs.io/en/latest/analytics/6bc283c4-21f2-4aed-a05c-a9a3ffa95dd4.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.005/T1218.005.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mshta_javascript.yml" ], "tags": [ @@ -71304,8 +71539,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://h.43z.one/ipconverter/", "https://twitter.com/Yasser_Elsnbary/status/1553804135354564608", + "https://h.43z.one/ipconverter/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_obfuscated_ip_download.yml" ], "tags": [ @@ -71362,8 +71597,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish", "http://www.irongeek.com/homoglyph-attack-generator.php", + "https://redcanary.com/threat-detection-report/threats/socgholish/#threat-socgholish", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_homoglyph_cyrillic_lookalikes.yml" ], "tags": [ @@ -71404,9 +71639,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/", "https://www.elevenforum.com/t/video-guide-how-to-completely-disable-microsoft-defender-antivirus.14608/page-2", "https://github.com/swagkarna/Defeat-Defender-V1.2.0", + "https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_reg_windows_defender_tamper.yml" ], "tags": [ @@ -71439,9 +71674,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://learn.microsoft.com/en-us/sysinternals/downloads/livekd", "https://kb.acronis.com/content/60892", "https://4sysops.com/archives/creating-a-complete-memory-dump-without-a-blue-screen/", - "https://learn.microsoft.com/en-us/sysinternals/downloads/livekd", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sysinternals_livekd_kernel_memory_dump.yml" ], "tags": [ @@ -71487,8 +71722,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2020/10/08/ryuks-return/", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", + "https://thedfirreport.com/2020/10/08/ryuks-return/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wmic_susp_process_creation.yml" ], "tags": [ @@ -71545,10 +71780,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37", + "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/", "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/", "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7", - "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/", - "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml" ], "tags": [ @@ -71689,11 +71924,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md", - "https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html", + "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil", "https://jdhnet.wordpress.com/2017/12/19/changing-the-location-of-the-windows-event-logs/", "https://gist.github.com/fovtran/ac0624983c7722e80a8f5a4babb170ee", - "https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md", + "https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_eventlog_clear.yml" ], "tags": [ @@ -72073,9 +72308,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.echotrail.io/insights/search/regsvr32.exe", - "https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo", "https://redcanary.com/blog/intelligence-insights-april-2022/", + "https://www.ired.team/offensive-security/code-execution/t1117-regsvr32-aka-squiblydoo", + "https://www.echotrail.io/insights/search/regsvr32.exe", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_susp_child_process.yml" ], "tags": [ @@ -72109,8 +72344,8 @@ "logsource.product": "windows", "refs": [ "https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/", - "https://www.scythe.io/library/threat-emulation-qakbot", "https://thedfirreport.com/2021/12/13/diavol-ransomware/", + "https://www.scythe.io/library/threat-emulation-qakbot", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_lolbin_exec_from_non_c_drive.yml" ], "tags": [ @@ -72200,8 +72435,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://learn.microsoft.com/en-us/windows/package-manager/winget/source", + "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winget_add_insecure_custom_source.yml" ], "tags": [ @@ -72335,11 +72570,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://isc.sans.edu/diary/22264", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-hive-conti-avoslocker", "https://lolbas-project.github.io/lolbas/Binaries/Bitsadmin/", - "https://isc.sans.edu/diary/22264", - "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", "https://www.cisa.gov/uscert/ncas/alerts/aa22-321a", + "https://blog.netspi.com/15-ways-to-download-a-file/#bitsadmin", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_download_file_sharing_domains.yml" ], "tags": [ @@ -72382,10 +72617,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/", "https://twitter.com/nao_sec/status/1530196847679401984", "https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/", "https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/", + "https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml" ], "tags": [ @@ -72459,8 +72694,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/", "https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/", + "https://lolbas-project.github.io/lolbas/Binaries/Aspnet_Compiler/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_aspnet_compiler_susp_child_process.yml" ], "tags": [ @@ -72528,8 +72763,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://asec.ahnlab.com/en/39828/", "https://twitter.com/GelosSnake/status/934900723426439170", + "https://asec.ahnlab.com/en/39828/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_system_exe_anomaly.yml" ], "tags": [ @@ -72562,8 +72797,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/VirtualAlllocEx/Payload-Download-Cradles/blob/88e8eca34464a547c90d9140d70e9866dcbc6a12/Download-Cradles.cmd", + "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_download_iex.yml" ], "tags": [ @@ -72697,8 +72932,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/windows/win32/shell/csidl", "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-russia-ukraine-military", + "https://learn.microsoft.com/en-us/windows/win32/shell/csidl", "https://www.virustotal.com/gui/file/91ba814a86ddedc7a9d546e26f912c541205b47a853d227756ab1334ade92c3f", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_script_exec_from_env_folder.yml" ], @@ -72756,8 +72991,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/bohops/status/994405551751815170", - "https://lolbas-project.github.io/lolbas/Scripts/Winrm/", "https://redcanary.com/blog/lateral-movement-winrm-wmi/", + "https://lolbas-project.github.io/lolbas/Scripts/Winrm/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winrm_execution_via_scripting_api_winrm_vbs.yml" ], "tags": [ @@ -72814,8 +73049,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/", "https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66", + "https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml" ], "tags": [ @@ -72922,8 +73157,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://learn.microsoft.com/en-us/windows/package-manager/winget/source", + "https://github.com/nasbench/Misc-Research/tree/b9596e8109dcdb16ec353f316678927e507a5b8d/LOLBINs/Winget", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_winget_add_custom_source.yml" ], "tags": [ @@ -73169,9 +73404,9 @@ "logsource.product": "windows", "refs": [ "https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html", - "https://youtu.be/5mqid-7zp8k?t=2481", "https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1", "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/", + "https://youtu.be/5mqid-7zp8k?t=2481", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_mailboxexport_share.yml" ], "tags": [ @@ -73297,8 +73532,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2021/12/13/diavol-ransomware/", "https://forums.veeam.com/veeam-backup-replication-f2/recover-esxi-password-in-veeam-t34630.html", + "https://thedfirreport.com/2021/12/13/diavol-ransomware/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_sqlcmd_veeam_dump.yml" ], "tags": [ @@ -73385,8 +73620,8 @@ "logsource.product": "windows", "refs": [ "https://www.microsoft.com/security/blog/2022/09/07/profiling-dev-0270-phosphorus-ransomware-operations/", - "https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html", "https://redacted.com/blog/bianlian-ransomware-gang-gives-it-a-go/", + "https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_net_default_accounts_manipulation.yml" ], "tags": [ @@ -73419,8 +73654,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md", "https://nasbench.medium.com/a-deep-dive-into-rundll32-exe-642344b41e90", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_registered_com_objects.yml" ], "tags": [ @@ -73585,8 +73820,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html", "https://www.hybrid-analysis.com/sample/465aabe132ccb949e75b8ab9c5bda36d80cf2fd503d52b8bad54e295f28bbc21?environmentId=100", + "https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_office_outlook_susp_child_processes.yml" ], "tags": [ @@ -73619,8 +73854,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/vxunderground/status/1423336151860002816?s=20", "https://www.virustotal.com/gui/file/03e9b8c2e86d6db450e5eceec057d7e369ee2389b9daecaf06331a95410aa5f8/detection", + "https://twitter.com/vxunderground/status/1423336151860002816?s=20", "https://pentestlab.blog/2018/07/04/dumping-domain-password-hashes/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_shadowcopy_access.yml" ], @@ -73654,8 +73889,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec", "https://twitter.com/_st0pp3r_/status/1583914515996897281", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msiexec_execute_dll.yml" ], @@ -73757,9 +73992,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://community.spiceworks.com/topic/2195015-batch-script-to-uninstall-symantec-endpoint-protection", - "https://www.exploit-db.com/exploits/37525", "https://community.broadcom.com/symantecenterprise/communities/community-home/digestviewer/viewthread?MessageKey=6ce94b67-74e1-4333-b16f-000b7fd874f0&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=digestviewer", + "https://www.exploit-db.com/exploits/37525", + "https://community.spiceworks.com/topic/2195015-batch-script-to-uninstall-symantec-endpoint-protection", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_taskkill_sep.yml" ], "tags": [ @@ -73911,8 +74146,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/WithSecureLabs/iocs/blob/344203de742bb7e68bd56618f66d34be95a9f9fc/FIN7VEEAM/iocs.csv", + "https://labs.withsecure.com/publications/fin7-target-veeam-servers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_curl_download_susp_file_sharing_domains.yml" ], "tags": [ @@ -74076,8 +74311,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.cobaltstrike.com/help-opsec", "https://twitter.com/ber_m1ng/status/1397948048135778309", + "https://www.cobaltstrike.com/help-opsec", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_no_params.yml" ], "tags": [ @@ -74154,11 +74389,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services", - "https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6", "https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe", - "https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/", + "https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/generating-the-data-service-client-library-wcf-data-services", "https://docs.microsoft.com/en-us/dotnet/framework/data/wcf/how-to-add-a-data-service-reference-wcf-data-services", + "https://gist.github.com/teixeira0xfffff/837e5bfed0d1b0a29a7cb1e5dbdd9ca6", + "https://lolbas-project.github.io/lolbas/Binaries/DataSvcUtil/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_data_exfiltration_by_using_datasvcutil.yml" ], "tags": [ @@ -74233,10 +74468,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg", - "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/", "https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html", + "https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955", + "https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml" ], @@ -74270,9 +74505,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63", - "https://abuse.io/lockergoga.txt", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil", + "https://abuse.io/lockergoga.txt", + "https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml" ], "tags": [ @@ -74415,9 +74650,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://github.com/SigmaHQ/sigma/issues/1009", "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/", "https://redcanary.com/blog/raspberry-robin/", - "https://github.com/SigmaHQ/sigma/issues/1009", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_shellexec_execution.yml" ], "tags": [ @@ -74607,8 +74842,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/OTRF/detection-hackathon-apt29/issues/6", "https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/3.B.2_C36B49B5-DF58-4A34-9FE9-56189B9DEFEA.md", + "https://github.com/OTRF/detection-hackathon-apt29/issues/6", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_sdclt.yml" ], "tags": [ @@ -74675,8 +74910,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://klausjochem.me/2016/02/03/netsh-the-cyber-attackers-tool-of-choice/", "https://blogs.msdn.microsoft.com/canberrapfe/2012/03/30/capture-a-network-trace-without-installing-anything-capture-a-network-trace-of-a-reboot/", + "https://klausjochem.me/2016/02/03/netsh-the-cyber-attackers-tool-of-choice/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_packet_capture.yml" ], "tags": [ @@ -74743,9 +74978,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html", - "https://github.com/binderlabs/DirCreate2System", "https://www.echotrail.io/insights/search/wermgr.exe", + "https://github.com/binderlabs/DirCreate2System", + "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wermgr_susp_child_process.yml" ], "tags": [ @@ -74809,9 +75044,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/", "https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan", "https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/", - "https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_ssm_agent_abuse.yml" ], "tags": [ @@ -74846,8 +75081,8 @@ "logsource.product": "windows", "refs": [ "https://learn.microsoft.com/en-us/windows/wsl/install-on-server", - "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system", "https://docs.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps", + "https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_enable_susp_windows_optional_feature.yml" ], "tags": [ @@ -74893,9 +75128,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176", "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/", + "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install_susp.yml" ], "tags": [ @@ -74993,8 +75228,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml", "https://twitter.com/pabraeken/status/993298228840992768", + "https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml" ], "tags": [ @@ -75036,8 +75271,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon", "https://www.cybereason.com/blog/threat-analysis-report-lockbit-2.0-all-paths-lead-to-ransom", + "https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml" ], "tags": [ @@ -75119,9 +75354,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", "https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176", "https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/", + "https://lolbas-project.github.io/lolbas/Binaries/Odbcconf/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_odbcconf_driver_install.yml" ], "tags": [ @@ -75221,24 +75456,24 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/samratashok/nishang", - "https://github.com/HarmJ0y/DAMP", - "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", - "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html", - "https://github.com/adrecon/AzureADRecon", + "https://github.com/adrecon/ADRecon", "https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1", "https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/", - "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", - "https://github.com/calebstewart/CVE-2021-1675", - "https://github.com/adrecon/ADRecon", - "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", "https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1", - "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", - "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1", - "https://github.com/besimorhino/powercat", - "https://github.com/Kevin-Robertson/Powermad", - "https://adsecurity.org/?p=2921", + "https://github.com/samratashok/nishang", + "https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html", + "https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/", "https://github.com/DarkCoderSc/PowerRunAsSystem/", + "https://github.com/adrecon/AzureADRecon", + "https://github.com/besimorhino/powercat", + "https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1", + "https://github.com/HarmJ0y/DAMP", + "https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1", + "https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries", + "https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1", + "https://github.com/calebstewart/CVE-2021-1675", + "https://adsecurity.org/?p=2921", + "https://github.com/Kevin-Robertson/Powermad", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml" ], "tags": [ @@ -75361,8 +75596,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec", "https://twitter.com/_st0pp3r_/status/1583914244344799235", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet.yml" ], @@ -75396,9 +75631,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6", - "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html", "https://www.hackingarticles.in/rdp-session-hijacking-with-tscon/", + "http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html", + "https://medium.com/@networksecurity/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_tscon_rdp_redirect.yml" ], "tags": [ @@ -75473,8 +75708,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar", + "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml" ], "tags": [ @@ -75524,8 +75759,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe", "https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1059.003/T1059.003.md", + "https://web.archive.org/web/20220306121156/https://www.x86matthew.com/view_post?id=ntdll_pipe", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_stdin_redirect.yml" ], "tags": [ @@ -75558,8 +75793,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.mandiant.com/resources/telegram-malware-iranian-espionage", "https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode", + "https://www.mandiant.com/resources/telegram-malware-iranian-espionage", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_screenconnect_anomaly.yml" ], "tags": [ @@ -75592,8 +75827,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://brica.de/alerts/alert/public/1247926/agent-tesla-keylogger-delivered-inside-a-power-iso-daa-archive/", + "https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_whoami.yml" ], "tags": [ @@ -75768,8 +76003,8 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/mrd0x/status/1461041276514623491", - "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/", "https://twitter.com/tccontre18/status/1480950986650832903", + "https://lolbas-project.github.io/lolbas/Binaries/Regsvr32/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regsvr32_network_pattern.yml" ], "tags": [ @@ -76253,9 +76488,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html", "https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.001/T1218.001.md", + "https://eqllib.readthedocs.io/en/latest/analytics/b25aa548-7937-11e9-8f5c-d46d6d62a49e.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hh_chm_execution.yml" ], "tags": [ @@ -76371,8 +76606,8 @@ "logsource.product": "windows", "refs": [ "https://news.sophos.com/en-us/2022/01/19/zloader-installs-remote-access-backdoors-and-delivers-cobalt-strike/", - "https://www.gpg4win.de/documentation.html", "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html", + "https://www.gpg4win.de/documentation.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_gpg4win_encryption.yml" ], "tags": [ @@ -76395,10 +76630,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware", "https://www.acronis.com/en-us/blog/posts/lockbit-ransomware/", "https://blog.sygnia.co/kaseya-ransomware-supply-chain-attack", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/blackbyte-exbyte-ransomware", + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_ping_del_combined_execution.yml" ], "tags": [ @@ -76522,9 +76757,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.mandiant.com/resources/blog/lnk-between-browsers", "https://emkc.org/s/RJjuLa", "https://redcanary.com/blog/chromeloader/", + "https://www.mandiant.com/resources/blog/lnk-between-browsers", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_browsers_chromium_susp_load_extension.yml" ], "tags": [ @@ -76591,8 +76826,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/jpillora/chisel/", "https://blog.sekoia.io/lucky-mouse-incident-response-to-detection-engineering/", + "https://github.com/jpillora/chisel/", "https://arcticwolf.com/resources/blog/lorenz-ransomware-chiseling-in/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_pua_chisel.yml" ], @@ -76626,8 +76861,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html", "https://mobile.twitter.com/0gtweet/status/1564131230941122561", + "https://strontic.github.io/xcyclopedia/library/DeviceEnroller.exe-24BEF0D6B0ECED36BB41831759FDE18D.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_deviceenroller_dll_sideloading.yml" ], "tags": [ @@ -76660,10 +76895,10 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/bohops/status/980659399495741441", + "https://twitter.com/JohnLaTwC/status/1223292479270600706", "https://gist.github.com/bohops/735edb7494fe1bd1010d67823842b712", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md", - "https://twitter.com/JohnLaTwC/status/1223292479270600706", - "https://twitter.com/bohops/status/980659399495741441", "https://lolbas-project.github.io/lolbas/Scripts/Manage-bde/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_manage_bde.yml" ], @@ -76744,11 +76979,11 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html", "https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe", - "https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html", "https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html", + "https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html", + "https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_net_susp_execution.yml" ], "tags": [ @@ -76855,8 +77090,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp", "https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/", + "https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp", "https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml" ], @@ -76890,9 +77125,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/pabraeken/status/993298228840992768", "https://docs.microsoft.com/en-us/windows-hardware/drivers/taef/", "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/", + "https://twitter.com/pabraeken/status/993298228840992768", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml" ], "tags": [ @@ -76991,8 +77226,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/", + "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rpd_file_susp_parent.yml" ], "tags": [ @@ -77049,9 +77284,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html", - "https://github.com/binderlabs/DirCreate2System", "https://www.echotrail.io/insights/search/wermgr.exe", + "https://github.com/binderlabs/DirCreate2System", + "https://www.trendmicro.com/en_us/research/22/j/black-basta-infiltrates-networks-via-qakbot-brute-ratel-and-coba.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_wermgr_susp_exec_location.yml" ], "tags": [ @@ -77148,8 +77383,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf", "https://www.cybereason.com/blog/research/operation-ghostshell-novel-rat-targets-global-aerospace-and-telecoms-firms", + "https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf", "https://businessinsights.bitdefender.com/deep-dive-into-a-backdoordiplomacy-attack-a-study-of-an-attackers-toolkit", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_csvde_export.yml" ], @@ -77173,9 +77408,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://isc.sans.edu/diary/Wipe+the+drive+Stealthy+Malware+Persistence+Mechanism+-+Part+1/15394", "http://0xthem.blogspot.com/2014/03/t-emporal-persistence-with-and-schtasks.html", - "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_bitsadmin_potential_persistence.yml" ], "tags": [ @@ -77208,9 +77443,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://twitter.com/CyberRaiju/status/1273597319322058752", "https://twitter.com/bohops/status/1276357235954909188?s=12", "https://securityboulevard.com/2019/09/deobfuscating-ostap-trickbots-34000-line-javascript-downloader/", - "https://twitter.com/CyberRaiju/status/1273597319322058752", "https://twitter.com/nas_bench/status/1535322450858233858", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_explorer_break_process_tree.yml" ], @@ -77277,8 +77512,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md#atomic-test-3---allow-smb-and-rdp-on-microsoft-defender-firewall", + "https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_netsh_fw_enable_group_rule.yml" ], "tags": [ @@ -77451,8 +77686,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Print/", "https://twitter.com/Oddvarmoe/status/985518877076541440", + "https://lolbas-project.github.io/lolbas/Binaries/Print/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml" ], "tags": [ @@ -77519,8 +77754,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/nas_bench/status/1550836225652686848", "https://persistence-info.github.io/Data/windowsterminalprofile.html", + "https://twitter.com/nas_bench/status/1550836225652686848", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_windows_terminal_susp_children.yml" ], "tags": [ @@ -77544,8 +77779,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/BloodHoundAD/BloodHound", "https://github.com/BloodHoundAD/SharpHound", + "https://github.com/BloodHoundAD/BloodHound", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml" ], "tags": [ @@ -77686,13 +77921,13 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", + "https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1", + "https://github.com/zcgonvh/NTDSDumpEx", "https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/", "https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Gather/Copy-VSS.ps1", "https://pentestlab.blog/tag/ntds-dit/", - "https://github.com/zcgonvh/NTDSDumpEx", - "https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration", "https://github.com/rapid7/metasploit-framework/blob/d297adcebb5c1df6fe30b12ca79b161deb71571c/data/post/powershell/NTDSgrab.ps1", - "https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html?m=1", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_ntds.yml" ], "tags": [ @@ -77865,9 +78100,9 @@ "logsource.product": "windows", "refs": [ "https://twitter.com/JAMESWT_MHT/status/1699042827261391247", - "https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries", "https://twitter.com/M_haggis/status/1699056847154725107", "https://www.virustotal.com/gui/file/339ff720c74dc44265b917b6d3e3ba0411d61f3cd3c328e9a2bae81592c8a6e5/content", + "https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_registry_ie_security_zone_protocol_defaults_downgrade.yml" ], "tags": [ @@ -77924,8 +78159,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://ss64.com/nt/mklink.html", "https://github.com/redcanaryco/atomic-red-team/blob/5c1e6f1b4fafd01c8d1ece85f510160fc1275fbf/atomics/T1546.008/T1546.008.md", + "https://ss64.com/nt/mklink.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_cmd_mklink_osk_cmd.yml" ], "tags": [ @@ -78091,8 +78326,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/Binaries/Replace/", "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/replace", + "https://lolbas-project.github.io/lolbas/Binaries/Replace/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_replace.yml" ], "tags": [ @@ -78184,8 +78419,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/pabraeken/status/991335019833708544", "https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/", + "https://twitter.com/pabraeken/status/991335019833708544", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml" ], "tags": [ @@ -78284,9 +78519,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/", "https://www.hybrid-analysis.com/sample/8da5b75b6380a41eee3a399c43dfe0d99eeefaa1fd21027a07b1ecaa4cd96fdd?environmentId=120", "https://web.archive.org/web/20180331144337/https://www.fireeye.com/blog/threat-research/2018/03/sanny-malware-delivery-method-updated-in-recently-observed-attacks.html", + "https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_susp_copy_system_dir_lolbin.yml" ], "tags": [ @@ -78319,9 +78554,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus", "https://twitter.com/AdamTheAnalyst/status/1483497517119590403", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md", - "https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-process-opened-file-exclusions-microsoft-defender-antivirus", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_base64_mppreference.yml" ], "tags": [ @@ -78431,8 +78666,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Openwith.yml", "https://twitter.com/harr0ey/status/991670870384021504", + "https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Openwith.yml", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_openwith.yml" ], "tags": [ @@ -78507,9 +78742,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0", - "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", "https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar", + "https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/", + "https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml" ], "tags": [ @@ -78552,8 +78787,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04", "https://www.welivesecurity.com/2022/01/18/donot-go-do-not-respawn/", + "https://www.joesandbox.com/analysis/514608/0/html#324415FF7D8324231381BAD48A052F85DF04", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_schtasks_env_folder.yml" ], "tags": [ @@ -78709,8 +78944,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5", "https://twitter.com/mrd0x/status/1463526834918854661", + "https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml" ], "tags": [ @@ -78809,8 +79044,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/mrd0x/status/1465058133303246867", "https://docs.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps", + "https://twitter.com/mrd0x/status/1465058133303246867", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml" ], "tags": [ @@ -78953,8 +79188,8 @@ "logsource.product": "windows", "refs": [ "https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f", - "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/regini", "https://lolbas-project.github.io/lolbas/Binaries/Regini/", + "https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/regini", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_regini_ads.yml" ], "tags": [ @@ -79101,8 +79336,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/", + "https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_mstsc_run_local_rdp_file_susp_location.yml" ], "tags": [ @@ -79214,8 +79449,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://www.echotrail.io/insights/search/msbuild.exe", "https://app.any.run/tasks/abdf586e-df0c-4d39-89a7-06bf24913401/", + "https://www.echotrail.io/insights/search/msbuild.exe", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_msbuild_susp_parent_process.yml" ], "tags": [ @@ -79272,9 +79507,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md", "https://ss64.com/bash/rar.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1560.001/T1560.001.md", + "https://labs.sentinelone.com/the-anatomy-of-an-apt-attack-and-cobaltstrike-beacons-encoded-configuration/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rar_compression_with_password.yml" ], "tags": [ @@ -79330,8 +79565,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/Hexacorn/status/1224848930795552769", "http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/", + "https://twitter.com/Hexacorn/status/1224848930795552769", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_advpack_obfuscated_ordinal_call.yml" ], "tags": [ @@ -79355,8 +79590,8 @@ "logsource.product": "windows", "refs": [ "https://medium.com/tenable-techblog/uac-bypass-by-mocking-trusted-directories-24a96675f6e", - "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows", "https://github.com/netero1010/TrustedPath-UACBypass-BOF", + "https://www.wietzebeukema.nl/blog/hijacking-dlls-in-windows", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_uac_bypass_trustedpath.yml" ], "tags": [ @@ -79667,8 +79902,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/", "https://twitter.com/harr0ey/status/992008180904419328", + "https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_susp_dxcap.yml" ], "tags": [ @@ -79734,8 +79969,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/", "https://lolbas-project.github.io/lolbas/Binaries/Xwizard/", + "http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_lolbin_dll_sideload_xwizard.yml" ], "tags": [ @@ -79911,8 +80146,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md", "https://eqllib.readthedocs.io/en/latest/analytics/fcdb99c2-ac3c-4bde-b664-4b336329bed2.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1124/T1124.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_remote_time_discovery.yml" ], "tags": [ @@ -80001,8 +80236,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20", "https://support.anydesk.com/Automatic_Deployment", + "https://twitter.com/TheDFIRReport/status/1423361119926816776?s=20", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk_silent_install.yml" ], "tags": [ @@ -80035,9 +80270,9 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ + "https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html", "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/", "https://www.softpedia.com/get/Antivirus/Removal-Tools/ithurricane-PowerTool.shtml", - "https://www.trendmicro.com/en_us/research/22/i/play-ransomware-s-attack-playbook-unmasks-it-as-another-hive-aff.html", "https://twitter.com/gbti_sa/status/1249653895900602375?lang=en", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_hktl_powertool.yml" ], @@ -80071,8 +80306,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/rikvduijn/status/853251879320662017", "https://twitter.com/felixw3000/status/853354851128025088", + "https://twitter.com/rikvduijn/status/853251879320662017", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_rundll32_susp_control_dll_load.yml" ], "tags": [ @@ -80105,8 +80340,8 @@ "logsource.category": "process_creation", "logsource.product": "windows", "refs": [ - "https://twitter.com/0gtweet/status/1674399582162153472", "https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/", + "https://twitter.com/0gtweet/status/1674399582162153472", "https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml" ], "tags": [ @@ -80139,8 +80374,8 @@ "logsource.category": "antivirus", "logsource.product": "No established product", "refs": [ - "https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619", "https://www.nextron-systems.com/?s=antivirus", + "https://www.virustotal.com/gui/file/5fcda49ee7f202559a6cbbb34edb65c33c9a1e0bde9fa2af06a6f11b55ded619", "https://www.virustotal.com/gui/file/a4edfbd42595d5bddb442c82a02cf0aaa10893c1bf79ea08b9ce576f82749448", "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_password_dumper.yml" ], @@ -80198,8 +80433,8 @@ "logsource.category": "antivirus", "logsource.product": "No established product", "refs": [ - "https://twitter.com/mvelazco/status/1410291741241102338", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1675", + "https://twitter.com/mvelazco/status/1410291741241102338", "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527", "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_printernightmare_cve_2021_34527.yml" ], @@ -80266,9 +80501,9 @@ "logsource.category": "antivirus", "logsource.product": "No established product", "refs": [ - "https://www.virustotal.com/gui/file/925b0b28472d4d79b4bf92050e38cc2b8f722691c713fc28743ac38551bc3797", "https://www.virustotal.com/gui/file/8f8daabe1c8ceb5710949283818e16c4aa8059bf2ce345e2f2c90b8692978424", "https://www.nextron-systems.com/?s=antivirus", + "https://www.virustotal.com/gui/file/925b0b28472d4d79b4bf92050e38cc2b8f722691c713fc28743ac38551bc3797", "https://www.virustotal.com/gui/file/d9669f7e3eb3a9cdf6a750eeb2ba303b5ae148a43e36546896f1d1801e912466", "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_exploiting.yml" ], @@ -80311,8 +80546,8 @@ "logsource.category": "antivirus", "logsource.product": "No established product", "refs": [ - "https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/", "https://www.nextron-systems.com/?s=antivirus", + "https://www.nextron-systems.com/2021/08/16/antivirus-event-analysis-cheat-sheet-v1-8-2/", "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_hacktool.yml" ], "tags": [ @@ -80345,16 +80580,16 @@ "logsource.category": "antivirus", "logsource.product": "No established product", "refs": [ - "https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection", - "https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection", - "https://github.com/tennc/webshell", - "https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection", - "https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection", - "https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection", - "https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection", "https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection", - "https://www.nextron-systems.com/?s=antivirus", + "https://www.virustotal.com/gui/file/b219f7d3c26f8bad7e175934cd5eda4ddb5e3983503e94ff07d39c0666821b7e/detection", + "https://www.virustotal.com/gui/file/bd1d52289203866645e556e2766a21d2275877fbafa056a76fe0cf884b7f8819/detection", "https://www.virustotal.com/gui/file/7d3cb8a8ff28f82b07f382789247329ad2d7782a72dde9867941f13266310c80/detection", + "https://www.virustotal.com/gui/file/308487ed28a3d9abc1fec7ebc812d4b5c07ab025037535421f64c60d3887a3e8/detection", + "https://www.virustotal.com/gui/file/a80042c61a0372eaa0c2c1e831adf0d13ef09feaf71d1d20b216156269045801/detection", + "https://www.virustotal.com/gui/file/b8702acf32fd651af9f809ed42d15135f842788cd98d81a8e1b154ee2a2b76a2/detection", + "https://www.nextron-systems.com/?s=antivirus", + "https://www.virustotal.com/gui/file/e841675a4b82250c75273ebf0861245f80c6a1c3d5803c2d995d9d3b18d5c4b5/detection", + "https://github.com/tennc/webshell", "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_webshell.yml" ], "tags": [ @@ -80388,11 +80623,11 @@ "logsource.product": "No established product", "refs": [ "https://www.virustotal.com/gui/file/69fe77dd558e281621418980040e2af89a2547d377d0f2875502005ce22bc95c", + "https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916", "https://www.virustotal.com/gui/file/554db97ea82f17eba516e6a6fdb9dc04b1d25580a1eb8cb755eeb260ad0bd61d", "https://www.virustotal.com/gui/file/c312c05ddbd227cbb08958876df2b69d0f7c1b09e5689eb9d93c5b357f63eff7", - "https://www.virustotal.com/gui/file/43b0f7872900bd234975a0877744554f4f355dc57505517abd1ef611e1ce6916", - "https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045", "https://www.nextron-systems.com/?s=antivirus", + "https://www.virustotal.com/gui/file/20179093c59bca3acc6ce9a4281e8462f577ffd29fd7bf51cf2a70d106062045", "https://github.com/SigmaHQ/sigma/tree/master/rules/category/antivirus/av_ransomware.yml" ], "tags": [ @@ -80561,8 +80796,8 @@ "logsource.category": "No established category", "logsource.product": "okta", "refs": [ - "https://developer.okta.com/docs/reference/api/system-log/", "https://github.com/okta/workflows-templates/blob/master/workflows/suspicious_activity_reported/readme.md", + "https://developer.okta.com/docs/reference/api/system-log/", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_suspicious_activity_enduser_report.yml" ], "tags": [ @@ -80842,8 +81077,8 @@ "logsource.product": "okta", "refs": [ "https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data", - "https://developer.okta.com/docs/reference/api/system-log/", "https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm", + "https://developer.okta.com/docs/reference/api/system-log/", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/okta/okta_password_in_alternateid_field.yml" ], "tags": [ @@ -81021,7 +81256,7 @@ "logsource.product": "m365", "refs": [ "https://research.splunk.com/cloud/c783dd98-c703-4252-9e8a-f19d9f5c949e/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_disabling_mfa.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/audit/microsoft365_disabling_mfa.yml" ], "tags": [ "attack.persistence", @@ -81040,6 +81275,77 @@ "uuid": "60de9b57-dc4d-48b9-a6a0-b39e0469f876", "value": "Disabling Multi Factor Authentication" }, + { + "description": "Detects the addition of a new Federated Domain.", + "meta": { + "author": "Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)", + "creation_date": "2023/09/18", + "falsepositive": [ + "The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider." + ], + "filename": "microsoft365_new_federated_domain_added_audit.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "m365", + "refs": [ + "https://o365blog.com/post/aadbackdoor/", + "https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/audit/microsoft365_new_federated_domain_added_audit.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1136.003" + ] + }, + "related": [ + { + "dest-uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "58f88172-a73d-442b-94c9-95eaed3cbb36", + "value": "New Federated Domain Added" + }, + { + "description": "Detects the addition of a new Federated Domain.", + "meta": { + "author": "Splunk Threat Research Team (original rule), '@ionsor (rule)'", + "creation_date": "2022/02/08", + "falsepositive": [ + "The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider." + ], + "filename": "microsoft365_new_federated_domain_added_exchange.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "m365", + "refs": [ + "https://us-cert.cisa.gov/ncas/alerts/aa21-008a", + "https://www.sygnia.co/golden-saml-advisory", + "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", + "https://o365blog.com/post/aadbackdoor/", + "https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/exchange/microsoft365_new_federated_domain_added_exchange.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1136.003" + ] + }, + "related": [ + { + "dest-uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "42127bdd-9133-474f-a6f1-97b6c08a4339", + "value": "New Federated Domain Added - Exchange" + }, { "description": "Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.", "meta": { @@ -81053,9 +81359,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_activity_from_anonymous_ip_addresses.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_activity_from_anonymous_ip_addresses.yml" ], "tags": [ "attack.command_and_control", @@ -81087,9 +81393,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_data_exfiltration_to_unsanctioned_app.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_data_exfiltration_to_unsanctioned_app.yml" ], "tags": [ "attack.exfiltration", @@ -81108,40 +81414,6 @@ "uuid": "2b669496-d215-47d8-bd9a-f4a45bf07cda", "value": "Data Exfiltration to Unsanctioned Apps" }, - { - "description": "Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.\nThese IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.\n", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/23", - "falsepositive": [ - "Unknown" - ], - "filename": "microsoft365_from_susp_ip_addresses.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "m365", - "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", - "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_from_susp_ip_addresses.yml" - ], - "tags": [ - "attack.command_and_control", - "attack.t1573" - ] - }, - "related": [ - { - "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "a3501e8e-af9e-43c6-8cd6-9360bdaae498", - "value": "Activity from Suspicious IP Addresses" - }, { "description": "Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.", "meta": { @@ -81155,9 +81427,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_susp_inbox_forwarding.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_susp_inbox_forwarding.yml" ], "tags": [ "attack.exfiltration", @@ -81189,9 +81461,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_activity_by_terminated_user.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_activity_by_terminated_user.yml" ], "tags": [ "attack.impact" @@ -81200,43 +81472,6 @@ "uuid": "2e669ed8-742e-4fe5-b3c4-5a59b486c2ee", "value": "Activity Performed by Terminated User" }, - { - "description": "Detects the addition of a new Federated Domain.", - "meta": { - "author": "Splunk Threat Research Team (original rule), '@ionsor (rule)'", - "creation_date": "2022/02/08", - "falsepositive": [ - "The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider." - ], - "filename": "microsoft365_new_federated_domain_added_exchange.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "m365", - "refs": [ - "https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html", - "https://o365blog.com/post/aadbackdoor/", - "https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf", - "https://www.sygnia.co/golden-saml-advisory", - "https://us-cert.cisa.gov/ncas/alerts/aa21-008a", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_new_federated_domain_added_exchange.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1136.003" - ] - }, - "related": [ - { - "dest-uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "42127bdd-9133-474f-a6f1-97b6c08a4339", - "value": "New Federated Domain Added - Exchange" - }, { "description": "Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.", "meta": { @@ -81250,9 +81485,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_logon_from_risky_ip_address.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_logon_from_risky_ip_address.yml" ], "tags": [ "attack.initial_access", @@ -81285,7 +81520,7 @@ "logsource.product": "m365", "refs": [ "https://learn.microsoft.com/en-us/powershell/module/exchange/new-compliancesearchaction?view=exchange-ps", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_pst_export_alert_using_new_compliancesearchaction.yml" ], "tags": [ "attack.collection", @@ -81317,9 +81552,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_unusual_volume_of_file_deletion.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_unusual_volume_of_file_deletion.yml" ], "tags": [ "attack.impact", @@ -81351,9 +81586,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_user_restricted_from_sending_email.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_user_restricted_from_sending_email.yml" ], "tags": [ "attack.initial_access", @@ -81385,9 +81620,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_susp_oauth_app_file_download_activities.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_susp_oauth_app_file_download_activities.yml" ], "tags": [ "attack.exfiltration" @@ -81409,9 +81644,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_impossible_travel_activity.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_impossible_travel_activity.yml" ], "tags": [ "attack.initial_access", @@ -81443,9 +81678,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_potential_ransomware_activity.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_potential_ransomware_activity.yml" ], "tags": [ "attack.impact", @@ -81464,40 +81699,6 @@ "uuid": "bd132164-884a-48f1-aa2d-c6d646b04c69", "value": "Microsoft 365 - Potential Ransomware Activity" }, - { - "description": "Detects the addition of a new Federated Domain.", - "meta": { - "author": "Splunk Threat Research Team (original rule), Harjot Singh @cyb3rjy0t (sigma rule)", - "creation_date": "2023/09/18", - "falsepositive": [ - "The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider." - ], - "filename": "microsoft365_new_federated_domain_added_audit.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "m365", - "refs": [ - "https://o365blog.com/post/aadbackdoor/", - "https://research.splunk.com/cloud/e155876a-6048-11eb-ae93-0242ac130002/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_new_federated_domain_added_audit.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1136.003" - ] - }, - "related": [ - { - "dest-uuid": "a009cb25-4801-4116-9105-80a91cf15c1b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "58f88172-a73d-442b-94c9-95eaed3cbb36", - "value": "New Federated Domain Added" - }, { "description": "Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content", "meta": { @@ -81512,7 +81713,7 @@ "logsource.product": "m365", "refs": [ "https://learn.microsoft.com/en-us/microsoft-365/compliance/alert-policies?view=o365-worldwide", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_pst_export_alert.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_pst_export_alert.yml" ], "tags": [ "attack.collection", @@ -81544,9 +81745,9 @@ "logsource.category": "No established category", "logsource.product": "m365", "refs": [ - "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/microsoft365_activity_from_infrequent_country.yml" + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_management/microsoft365_activity_from_infrequent_country.yml" ], "tags": [ "attack.command_and_control", @@ -81565,6 +81766,40 @@ "uuid": "0f2468a2-5055-4212-a368-7321198ee706", "value": "Activity from Infrequent Country" }, + { + "description": "Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.\nThese IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.\n", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/23", + "falsepositive": [ + "Unknown" + ], + "filename": "microsoft365_from_susp_ip_addresses.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "m365", + "refs": [ + "https://docs.microsoft.com/en-us/cloud-app-security/anomaly-detection-policy", + "https://docs.microsoft.com/en-us/cloud-app-security/policy-template-reference", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/m365/threat_detection/microsoft365_from_susp_ip_addresses.yml" + ], + "tags": [ + "attack.command_and_control", + "attack.t1573" + ] + }, + "related": [ + { + "dest-uuid": "b8902400-e6c5-4ba2-95aa-2d35b442b118", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "a3501e8e-af9e-43c6-8cd6-9360bdaae498", + "value": "Activity from Suspicious IP Addresses" + }, { "description": "Detects when a new member is added or invited to a github organization.", "meta": { @@ -81733,9 +81968,9 @@ "logsource.category": "No established category", "logsource.product": "github", "refs": [ - "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", - "https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization#dependabot_alerts-category-actions", + "https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization", + "https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/github/github_disable_high_risk_configuration.yml" ], "tags": [ @@ -81863,7 +82098,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/dns/docs/reference/v1/managedZones", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_dns_zone_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_dns_zone_modified_or_deleted.yml" ], "tags": [ "attack.impact" @@ -81887,7 +82122,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_kubernetes_secrets_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_kubernetes_secrets_modified_or_deleted.yml" ], "tags": [ "attack.credential_access" @@ -81912,7 +82147,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/sql/docs/mysql/admin-api/rest/v1beta4/users/update", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_sql_database_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_sql_database_modified_or_deleted.yml" ], "tags": [ "attack.impact" @@ -81936,7 +82171,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_service_account_modified.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_service_account_modified.yml" ], "tags": [ "attack.impact" @@ -81959,12 +82194,12 @@ "logsource.category": "No established category", "logsource.product": "gcp", "refs": [ - "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging", + "https://github.com/elastic/detection-rules/pull/1267", "https://kubernetes.io/docs/reference/access-authn-authz/rbac/", "https://cloud.google.com/kubernetes-engine/docs/how-to/role-based-access-control", - "https://github.com/elastic/detection-rules/pull/1267", "https://kubernetes.io/docs/reference/kubernetes-api/authorization-resources/cluster-role-v1/#ClusterRole", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_kubernetes_rolebinding.yml" + "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_kubernetes_rolebinding.yml" ], "tags": [ "attack.credential_access" @@ -81988,7 +82223,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/storage/docs/json_api/v1/buckets", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_bucket_enumeration.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_bucket_enumeration.yml" ], "tags": [ "attack.discovery" @@ -82011,10 +82246,10 @@ "logsource.category": "No established category", "logsource.product": "gcp", "refs": [ - "https://kubernetes.io/docs/concepts/workloads/controllers/job/", - "https://cloud.google.com/kubernetes-engine/docs", "https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_kubernetes_cronjob.yml" + "https://cloud.google.com/kubernetes-engine/docs", + "https://kubernetes.io/docs/concepts/workloads/controllers/job/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_kubernetes_cronjob.yml" ], "tags": [ "attack.persistence", @@ -82041,7 +82276,7 @@ "logsource.product": "gcp", "refs": [ "https://any-api.com/googleapis_com/compute/docs/vpnTunnels", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_vpn_tunnel_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_vpn_tunnel_modified_or_deleted.yml" ], "tags": [ "attack.impact" @@ -82066,7 +82301,7 @@ "refs": [ "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging", "https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.Firewalls.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_firewall_rule_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_firewall_rule_modified_or_deleted.yml" ], "tags": [ "attack.defense_evasion", @@ -82099,7 +82334,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/dlp/docs/reference/rest/v2/projects.content/reidentify", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_dlp_re_identifies_sensitive_information.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_dlp_re_identifies_sensitive_information.yml" ], "tags": [ "attack.impact", @@ -82133,7 +82368,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/kubernetes-engine/docs", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_kubernetes_admission_controller.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml" ], "tags": [ "attack.persistence", @@ -82184,7 +82419,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_service_account_disabled_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml" ], "tags": [ "attack.impact", @@ -82218,7 +82453,7 @@ "logsource.product": "gcp", "refs": [ "https://cloud.google.com/storage/docs/json_api/v1/buckets", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_bucket_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_bucket_modified_or_deleted.yml" ], "tags": [ "attack.impact" @@ -82241,9 +82476,9 @@ "logsource.category": "No established category", "logsource.product": "gcp", "refs": [ - "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging", "https://developers.google.com/resources/api-libraries/documentation/compute/v1/java/latest/com/google/api/services/compute/Compute.PacketMirrorings.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gcp_full_network_traffic_packet_capture.yml" + "https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/audit/gcp_full_network_traffic_packet_capture.yml" ], "tags": [ "attack.collection", @@ -82262,6 +82497,55 @@ "uuid": "980a7598-1e7f-4962-9372-2d754c930d0e", "value": "Google Full Network Traffic Packet Capture" }, + { + "description": "Detects when an a role privilege is deleted in Google Workspace.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/08/24", + "falsepositive": [ + "Unknown" + ], + "filename": "gcp_gworkspace_role_privilege_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "gcp", + "refs": [ + "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings", + "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_role_privilege_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "bf638ef7-4d2d-44bb-a1dc-a238252e6267", + "value": "Google Workspace Role Privilege Deleted" + }, + { + "description": "Detects when multi-factor authentication (MFA) is disabled.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/08/26", + "falsepositive": [ + "MFA may be disabled and performed by a system administrator." + ], + "filename": "gcp_gworkspace_mfa_disabled.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "gcp", + "refs": [ + "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION", + "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", + "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_mfa_disabled.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "780601d1-6376-4f2a-884e-b8d45599f78c", + "value": "Google Workspace MFA Disabled" + }, { "description": "Detects when an an application is removed from Google Workspace.", "meta": { @@ -82270,15 +82554,15 @@ "falsepositive": [ "Application being removed may be performed by a System Administrator." ], - "filename": "gworkspace_application_removed.yml", + "filename": "gcp_gworkspace_application_removed.yml", "level": "medium", "logsource.category": "No established category", - "logsource.product": "google_workspace", + "logsource.product": "gcp", "refs": [ - "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION", - "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION_FROM_WHITELIST", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gworkspace/gworkspace_application_removed.yml" + "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", + "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings?hl=en#REMOVE_APPLICATION", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_application_removed.yml" ], "tags": [ "attack.impact" @@ -82287,6 +82571,40 @@ "uuid": "ee2803f0-71c8-4831-b48b-a1fc57601ee4", "value": "Google Workspace Application Removed" }, + { + "description": "Detects when an API access service account is granted domain authority.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/08/23", + "falsepositive": [ + "Unknown" + ], + "filename": "gcp_gworkspace_granted_domain_api_access.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "gcp", + "refs": [ + "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", + "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings#AUTHORIZE_API_CLIENT_ACCESS", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_granted_domain_api_access.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1098" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "04e2a23a-9b29-4a5c-be3a-3542e3f982ba", + "value": "Google Workspace Granted Domain API Access" + }, { "description": "Detects when an Google Workspace user is granted admin privileges.", "meta": { @@ -82295,14 +82613,14 @@ "falsepositive": [ "Google Workspace admin role privileges, may be modified by system administrators." ], - "filename": "gworkspace_user_granted_admin_privileges.yml", + "filename": "gcp_gworkspace_user_granted_admin_privileges.yml", "level": "medium", "logsource.category": "No established category", - "logsource.product": "google_workspace", + "logsource.product": "gcp", "refs": [ "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-user-settings#GRANT_ADMIN_PRIVILEGE", "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gworkspace/gworkspace_user_granted_admin_privileges.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_user_granted_admin_privileges.yml" ], "tags": [ "attack.persistence", @@ -82329,14 +82647,14 @@ "falsepositive": [ "Unknown" ], - "filename": "gworkspace_role_modified_or_deleted.yml", + "filename": "gcp_gworkspace_role_modified_or_deleted.yml", "level": "medium", "logsource.category": "No established category", - "logsource.product": "google_workspace", + "logsource.product": "gcp", "refs": [ - "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gworkspace/gworkspace_role_modified_or_deleted.yml" + "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gcp/gworkspace/gcp_gworkspace_role_modified_or_deleted.yml" ], "tags": [ "attack.impact" @@ -82345,89 +82663,6 @@ "uuid": "6aef64e3-60c6-4782-8db3-8448759c714e", "value": "Google Workspace Role Modified or Deleted" }, - { - "description": "Detects when an a role privilege is deleted in Google Workspace.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/08/24", - "falsepositive": [ - "Unknown" - ], - "filename": "gworkspace_role_privilege_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "google_workspace", - "refs": [ - "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", - "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-delegated-admin-settings", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gworkspace/gworkspace_role_privilege_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "bf638ef7-4d2d-44bb-a1dc-a238252e6267", - "value": "Google Workspace Role Privilege Deleted" - }, - { - "description": "Detects when multi-factor authentication (MFA) is disabled.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/08/26", - "falsepositive": [ - "MFA may be disabled and performed by a system administrator." - ], - "filename": "gworkspace_mfa_disabled.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "google_workspace", - "refs": [ - "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", - "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings#ENFORCE_STRONG_AUTHENTICATION", - "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-security-settings?hl=en#ALLOW_STRONG_AUTHENTICATION", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gworkspace/gworkspace_mfa_disabled.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "780601d1-6376-4f2a-884e-b8d45599f78c", - "value": "Google Workspace MFA Disabled" - }, - { - "description": "Detects when an API access service account is granted domain authority.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/08/23", - "falsepositive": [ - "Unknown" - ], - "filename": "gworkspace_granted_domain_api_access.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "google_workspace", - "refs": [ - "https://developers.google.com/admin-sdk/reports/v1/appendix/activity/admin-domain-settings#AUTHORIZE_API_CLIENT_ACCESS", - "https://cloud.google.com/logging/docs/audit/gsuite-audit-logging#3", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/gworkspace/gworkspace_granted_domain_api_access.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1098" - ] - }, - "related": [ - { - "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "04e2a23a-9b29-4a5c-be3a-3542e3f982ba", - "value": "Google Workspace Granted Domain API Access" - }, { "description": "Detects when an user assumed another user account.", "meta": { @@ -82487,14 +82722,14 @@ "logsource.category": "No established category", "logsource.product": "aws", "refs": [ - "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html", - "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html", - "https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html", - "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html", - "https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html", "https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html", "https://github.com/elastic/detection-rules/pull/1145/files", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_s3_data_management_tampering.yml" + "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html", + "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketWebsite.html", + "https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html", + "https://docs.aws.amazon.com/AmazonS3/latest/API/API_RestoreObject.html", + "https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_s3_data_management_tampering.yml" ], "tags": [ "attack.exfiltration", @@ -82528,7 +82763,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DisableEbsEncryptionByDefault.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_ec2_disable_encryption.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_ec2_disable_encryption.yml" ], "tags": [ "attack.impact", @@ -82570,7 +82805,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/iam__backdoor_users_keys/main.py", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_iam_backdoor_users_keys.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml" ], "tags": [ "attack.persistence", @@ -82604,7 +82839,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/cli/latest/reference/securityhub/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_securityhub_finding_evasion.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_securityhub_finding_evasion.yml" ], "tags": [ "attack.defense_evasion", @@ -82637,7 +82872,7 @@ "logsource.product": "aws", "refs": [ "https://unit42.paloaltonetworks.com/compromised-cloud-compute-credentials/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_delete_identity.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_delete_identity.yml" ], "tags": [ "attack.defense_evasion", @@ -82670,7 +82905,7 @@ "logsource.product": "aws", "refs": [ "https://www.justice.gov/file/1080281/download", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_snapshot_backup_exfiltration.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_snapshot_backup_exfiltration.yml" ], "tags": [ "attack.exfiltration", @@ -82703,7 +82938,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_efs_fileshare_mount_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_efs_fileshare_mount_modified_or_deleted.yml" ], "tags": [ "attack.impact", @@ -82736,7 +82971,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transferred_to_another_account.toml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_route_53_domain_transferred_to_another_account.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml" ], "tags": [ "attack.persistence", @@ -82773,7 +83008,7 @@ "refs": [ "https://github.com/elastic/detection-rules/pull/1214", "https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_sts_assumerole_misuse.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_sts_assumerole_misuse.yml" ], "tags": [ "attack.lateral_movement", @@ -82823,7 +83058,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_rds_change_master_password.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_rds_change_master_password.yml" ], "tags": [ "attack.exfiltration", @@ -82856,7 +83091,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_elasticache_security_group_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml" ], "tags": [ "attack.impact", @@ -82890,9 +83125,9 @@ "logsource.category": "No established category", "logsource.product": "aws", "refs": [ - "https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html", "https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_susp_saml_activity.yml" + "https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_susp_saml_activity.yml" ], "tags": [ "attack.initial_access", @@ -82953,7 +83188,7 @@ "logsource.product": "aws", "refs": [ "https://any-api.com/amazonaws_com/eks/docs/API_Description", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_eks_cluster_created_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_eks_cluster_created_or_deleted.yml" ], "tags": [ "attack.impact", @@ -82986,7 +83221,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/rds__explore_snapshots/main.py", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_rds_public_db_restore.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_rds_public_db_restore.yml" ], "tags": [ "attack.exfiltration", @@ -83019,7 +83254,7 @@ "logsource.product": "aws", "refs": [ "https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_templated_s3_bucket_policy_creation.yml" ], "tags": [ "attack.execution", @@ -83061,7 +83296,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_cloudtrail_disable_logging.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_cloudtrail_disable_logging.yml" ], "tags": [ "attack.defense_evasion", @@ -83094,7 +83329,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_ec2_startup_script_change.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml" ], "tags": [ "attack.execution", @@ -83143,9 +83378,9 @@ "logsource.product": "aws", "refs": [ "https://jamesonhacking.blogspot.com/2020/12/pivoting-to-private-aws-s3-buckets.html", - "https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md", "https://securitycafe.ro/2022/12/14/aws-enumeration-part-ii-practical-enumeration/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_enum_buckets.yml" + "https://github.com/Lifka/hacking-resources/blob/c2ae355d381bd0c9f0b32c4ead049f44e5b1573f/cloud-hacking-cheat-sheets.md", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_enum_buckets.yml" ], "tags": [ "attack.discovery", @@ -83178,7 +83413,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_update_login_profile.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_update_login_profile.yml" ], "tags": [ "attack.persistence", @@ -83209,7 +83444,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-instance", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_ec2_vm_export_failure.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_ec2_vm_export_failure.yml" ], "tags": [ "attack.collection", @@ -83250,10 +83485,10 @@ "logsource.category": "No established category", "logsource.product": "aws", "refs": [ - "https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html", "https://docs.aws.amazon.com/singlesignon/latest/userguide/sso-info-in-cloudtrail.html", + "https://docs.aws.amazon.com/service-authorization/latest/reference/list_awsiamidentitycentersuccessortoawssinglesign-on.html", "https://docs.aws.amazon.com/singlesignon/latest/userguide/app-enablement.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_sso_idp_change.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_sso_idp_change.yml" ], "tags": [ "attack.persistence", @@ -83287,7 +83522,7 @@ "refs": [ "https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html", "https://github.com/elastic/detection-rules/pull/1213", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_sts_getsessiontoken_misuse.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_sts_getsessiontoken_misuse.yml" ], "tags": [ "attack.lateral_movement", @@ -83337,9 +83572,9 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html", - "https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html", "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ecs__backdoor_task_def/main.py", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_ecs_task_definition_cred_endpoint_query.yml" + "https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefinition.html", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_ecs_task_definition_cred_endpoint_query.yml" ], "tags": [ "attack.persistence", @@ -83372,7 +83607,7 @@ "logsource.product": "aws", "refs": [ "https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_iam_s3browser_loginprofile_creation.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_loginprofile_creation.yml" ], "tags": [ "attack.execution", @@ -83414,7 +83649,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/guardduty__whitelist_ip/main.py#L9", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_guardduty_disruption.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_guardduty_disruption.yml" ], "tags": [ "attack.defense_evasion", @@ -83448,7 +83683,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/lambda/latest/dg/API_UpdateFunctionConfiguration.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_attached_malicious_lambda_layer.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_attached_malicious_lambda_layer.yml" ], "tags": [ "attack.privilege_escalation" @@ -83470,10 +83705,10 @@ "logsource.category": "No established category", "logsource.product": "aws", "refs": [ - "https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html", - "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml", "https://docs.aws.amazon.com/Route53/latest/APIReference/API_domains_DisableDomainTransferLock.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_route_53_domain_transferred_lock_disabled.yml" + "https://github.com/elastic/detection-rules/blob/c76a39796972ecde44cb1da6df47f1b6562c9770/rules/integrations/aws/persistence_route_53_domain_transfer_lock_disabled.toml", + "https://docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53.html", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml" ], "tags": [ "attack.persistence", @@ -83507,7 +83742,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_efs_fileshare_modified_or_deleted.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_efs_fileshare_modified_or_deleted.yml" ], "tags": [ "attack.impact" @@ -83530,9 +83765,9 @@ "logsource.category": "No established category", "logsource.product": "aws", "refs": [ - "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_passed_role_to_glue_development_endpoint.yml" + "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_passed_role_to_glue_development_endpoint.yml" ], "tags": [ "attack.privilege_escalation" @@ -83555,7 +83790,7 @@ "logsource.product": "aws", "refs": [ "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_root_account_usage.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_root_account_usage.yml" ], "tags": [ "attack.privilege_escalation", @@ -83588,7 +83823,7 @@ "logsource.product": "aws", "refs": [ "https://permiso.io/blog/s/unmasking-guivil-new-cloud-threat-actor", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_iam_s3browser_user_or_accesskey_creation.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_iam_s3browser_user_or_accesskey_creation.yml" ], "tags": [ "attack.execution", @@ -83629,7 +83864,7 @@ "logsource.category": "No established category", "logsource.product": "aws", "refs": [ - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_config_disable_recording.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_config_disable_recording.yml" ], "tags": [ "attack.defense_evasion", @@ -83662,7 +83897,7 @@ "logsource.product": "aws", "refs": [ "https://github.com/elastic/detection-rules/blob/598f3d7e0a63221c0703ad9a0ea7e22e7bc5961e/rules/integrations/aws/persistence_elasticache_security_group_creation.toml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/aws_elasticache_security_group_created.yml" + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_created.yml" ], "tags": [ "attack.persistence", @@ -83689,3445 +83924,6 @@ "uuid": "4ae68615-866f-4304-b24b-ba048dfa5ca7", "value": "AWS ElastiCache Security Group Created" }, - { - "description": "Alert on when legecy authentication has been used on an account", - "meta": { - "author": "Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/06/17", - "falsepositive": [ - "User has been put in acception group so they can use legacy authentication" - ], - "filename": "azure_legacy_authentication_protocols.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_legacy_authentication_protocols.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1078.004", - "attack.t1110" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "60f6535a-760f-42a9-be3f-c9a0a025906e", - "value": "Use of Legacy Authentication Protocols" - }, - { - "description": "Detects when an end user consents to an application", - "meta": { - "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", - "creation_date": "2022/07/28", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_app_end_user_consent.yml", - "level": "low", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#end-user-consent", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_end_user_consent.yml" - ], - "tags": [ - "attack.credential_access", - "attack.t1528" - ] - }, - "related": [ - { - "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a", - "value": "End User Consent" - }, - { - "description": "Define a baseline threshold for failed sign-ins due to Conditional Access failures", - "meta": { - "author": "Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/06/01", - "falsepositive": [ - "Service Account misconfigured", - "Misconfigured Systems", - "Vulnerability Scanners" - ], - "filename": "azure_conditional_access_failure.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_conditional_access_failure.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1110", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "b4a6d707-9430-4f5f-af68-0337f52d5c42", - "value": "Sign-in Failure Due to Conditional Access Requirements Not Met" - }, - { - "description": "Detects when an app is assigned Azure AD roles, such as global adminsitrator, or Azure RBAC roles, such as subscription owner.", - "meta": { - "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", - "creation_date": "2022/07/19", - "falsepositive": [ - "When the permission is legitimately needed for the app" - ], - "filename": "azure_app_role_added.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#service-principal-assigned-to-a-role", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_role_added.yml" - ], - "tags": [ - "attack.persistence", - "attack.privilege_escalation", - "attack.t1098.003" - ] - }, - "related": [ - { - "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "b04934b2-0a68-4845-8a19-bdfed3a68a7a", - "value": "App Role Added" - }, - { - "description": "Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.\nThe application then uses those credentials to authenticate the user against the identity provider.\n", - "meta": { - "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", - "creation_date": "2022/06/01", - "falsepositive": [ - "Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow" - ], - "filename": "azure_app_ropc_authentication.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-authentication-flows", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_ropc_authentication.yml" - ], - "tags": [ - "attack.t1078", - "attack.defense_evasion", - "attack.persistence", - "attack.privilege_escalation", - "attack.initial_access" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "55695bc0-c8cf-461f-a379-2535f563c854", - "value": "Applications That Are Using ROPC Authentication Flow" - }, - { - "description": "Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.", - "meta": { - "author": "AlertIQ", - "creation_date": "2021/10/10", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_change_to_authentication_method.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_change_to_authentication_method.yml" - ], - "tags": [ - "attack.credential_access", - "attack.t1556", - "attack.persistence", - "attack.defense_evasion", - "attack.t1098" - ] - }, - "related": [ - { - "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "4d78a000-ab52-4564-88a5-7ab5242b20c7", - "value": "Change to Authentication Method" - }, - { - "description": "Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/08/10", - "falsepositive": [ - "A non malicious user is unaware of the proper process" - ], - "filename": "azure_guest_invite_failure.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_guest_invite_failure.yml" - ], - "tags": [ - "attack.persistence", - "attack.defense_evasion", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "0b4b72e3-4c53-4d5b-b198-2c58cfef39a9", - "value": "Guest User Invited By Non Approved Inviters" - }, - { - "description": "Identifies when a service principal is created in Azure.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/02", - "falsepositive": [ - "Service principal being created may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_service_principal_created.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_service_principal_created.yml" - ], - "tags": [ - "attack.defense_evasion" - ] - }, - "uuid": "0ddcff6d-d262-40b0-804b-80eb592de8e3", - "value": "Azure Service Principal Created" - }, - { - "description": "Identifies when a key vault is modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/16", - "falsepositive": [ - "Key Vault being modified or deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_keyvault_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_keyvault_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.credential_access", - "attack.t1552", - "attack.t1552.001" - ] - }, - "related": [ - { - "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "459a2970-bb84-4e6a-a32e-ff0fbd99448d", - "value": "Azure Key Vault Modified or Deleted" - }, - { - "description": "Detect access has been blocked by Conditional Access policies.\nThe access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.\n", - "meta": { - "author": "AlertIQ", - "creation_date": "2021/10/10", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_user_login_blocked_by_conditional_access.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_user_login_blocked_by_conditional_access.yml" - ], - "tags": [ - "attack.credential_access", - "attack.initial_access", - "attack.t1110", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "9a60e676-26ac-44c3-814b-0c2a8b977adf", - "value": "User Access Blocked by Azure Conditional Access" - }, - { - "description": "Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/08/10", - "falsepositive": [ - "Administrator adding a legitimate temporary access pass" - ], - "filename": "azure_tap_added.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_tap_added.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "fa84aaf5-8142-43cd-9ec2-78cfebf878ce", - "value": "Temporary Access Pass Added To An Account" - }, - { - "description": "Detects when a user has been elevated to manage all Azure Subscriptions.\nThis change should be investigated immediately if it isn't planned.\nThis setting could allow an attacker access to Azure subscriptions in your environment.\n", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/11/26", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_subscription_permissions_elevation_via_auditlogs.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#assignment-and-elevation", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_subscription_permissions_elevation_via_auditlogs.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "ca9bf243-465e-494a-9e54-bf9fc239057d", - "value": "Azure Subscription Permission Elevation Via AuditLogs" - }, - { - "description": "Detects when an account was created and deleted in a short period of time.", - "meta": { - "author": "Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton", - "creation_date": "2022/08/11", - "falsepositive": [ - "Legit administrative action" - ], - "filename": "azure_ad_account_created_deleted.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_account_created_deleted.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "6f583da0-3a90-4566-a4ed-83c09fe18bbf", - "value": "Account Created And Deleted Within A Close Time Frame" - }, - { - "description": "Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_firewall_rule_collection_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_firewall_rule_collection_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.defense_evasion", - "attack.t1562.004" - ] - }, - "related": [ - { - "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "025c9fe7-db72-49f9-af0d-31341dd7dd57", - "value": "Azure Firewall Rule Collection Modified or Deleted" - }, - { - "description": "Identifies when an admission controller is executed in Azure Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.\nAn adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/11/25", - "falsepositive": [ - "Azure Kubernetes Admissions Controller may be done by a system administrator.", - "If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_admission_controller.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_admission_controller.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1078", - "attack.credential_access", - "attack.t1552", - "attack.t1552.007" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f8ef3a62-3f44-40a4-abca-761ab235c436", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "a61a3c56-4ce2-4351-a079-88ae4cbd2b58", - "value": "Azure Kubernetes Admission Controller" - }, - { - "description": "Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.", - "meta": { - "author": "sawwinnnaung", - "creation_date": "2020/05/07", - "falsepositive": [ - "Valid change" - ], - "filename": "azure_rare_operations.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_rare_operations.yml" - ], - "tags": [ - "attack.t1003" - ] - }, - "related": [ - { - "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "c1182e02-49a3-481c-b3de-0fadc4091488", - "value": "Rare Subscription-level Operations In Azure" - }, - { - "description": "Detects when sign-ins increased by 10% or greater.", - "meta": { - "author": "Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'", - "creation_date": "2022/08/11", - "falsepositive": [ - "Unlikely" - ], - "filename": "azure_ad_auth_failure_increase.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_auth_failure_increase.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "e1d02b53-c03c-4948-b11d-4d00cca49d03", - "value": "Increased Failed Authentications Of Any Type" - }, - { - "description": "Monitor and alert for Bitlocker key retrieval.", - "meta": { - "author": "Michael Epping, '@mepples21'", - "creation_date": "2022/06/28", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_bitlocker_key_retrieval.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#bitlocker-key-retrieval", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_bitlocker_key_retrieval.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "a0413867-daf3-43dd-9245-734b3a787942", - "value": "Bitlocker Key Retrieval" - }, - { - "description": "Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", - "creation_date": "2022/06/02", - "falsepositive": [ - "When a new application owner is added by an administrator" - ], - "filename": "azure_app_owner_added.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#new-owner", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_owner_added.yml" - ], - "tags": [ - "attack.t1552", - "attack.credential_access" - ] - }, - "related": [ - { - "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "74298991-9fc4-460e-a92e-511aa60baec1", - "value": "Added Owner To Application" - }, - { - "description": "Identifies when a application gateway is modified or deleted.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/08/16", - "falsepositive": [ - "Application gateway being modified or deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_application_gateway_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_application_gateway_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "ad87d14e-7599-4633-ba81-aeb60cfe8cd6", - "value": "Azure Application Gateway Modified or Deleted" - }, - { - "description": "Detect when a user has reset their password in Azure AD", - "meta": { - "author": "YochanaHenderson, '@Yochana-H'", - "creation_date": "2022/08/03", - "falsepositive": [ - "If this was approved by System Administrator or confirmed user action." - ], - "filename": "azure_user_password_change.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_user_password_change.yml" - ], - "tags": [ - "attack.persistence", - "attack.credential_access", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "340ee172-4b67-4fb4-832f-f961bdc1f3aa", - "value": "Password Reset By User Account" - }, - { - "description": "Monitor and alert on group membership additions of groups that have CA policy modification access", - "meta": { - "author": "Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'", - "creation_date": "2022/08/04", - "falsepositive": [ - "User removed from the group is approved" - ], - "filename": "azure_group_user_addition_ca_modification.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_group_user_addition_ca_modification.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.persistence", - "attack.t1548", - "attack.t1556" - ] - }, - "related": [ - { - "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "91c95675-1f27-46d0-bead-d1ae96b97cd3", - "value": "User Added To Group With CA Policy Modification Access" - }, - { - "description": "Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.", - "meta": { - "author": "MikeDuddington, '@dudders1'", - "creation_date": "2022/06/30", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_users_authenticating_to_other_azure_ad_tenants.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-external-user-sign-ins", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_users_authenticating_to_other_azure_ad_tenants.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "5f521e4b-0105-4b72-845b-2198a54487b9", - "value": "Users Authenticating To Other Azure AD Tenants" - }, - { - "description": "Identifies when an user or application modified the federation settings on the domain.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/09/06", - "falsepositive": [ - "Federation Settings being modified or deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_federation_modified.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_federation_modified.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "352a54e1-74ba-4929-9d47-8193d67aba1e", - "value": "Azure Domain Federation Settings Modified" - }, - { - "description": "Identifies when a application security group is modified or deleted.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/08/16", - "falsepositive": [ - "Application security group being modified or deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Application security group modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_application_security_group_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_application_security_group_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "835747f1-9329-40b5-9cc3-97d465754ce6", - "value": "Azure Application Security Group Modified or Deleted" - }, - { - "description": "Detect when authentications to important application(s) only required single-factor authentication", - "meta": { - "author": "MikeDuddington, '@dudders1'", - "creation_date": "2022/07/28", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_ad_auth_to_important_apps_using_single_factor_auth.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_auth_to_important_apps_using_single_factor_auth.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "f272fb46-25f2-422c-b667-45837994980f", - "value": "Authentications To Important Apps Using Single Factor Authentication" - }, - { - "description": "Identifies the deletion of Azure Kubernetes Pods.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/07/24", - "falsepositive": [ - "Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Pods deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_pods_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_pods_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "b02f9591-12c3-4965-986a-88028629b2e1", - "value": "Azure Kubernetes Pods Deleted" - }, - { - "description": "Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", - "creation_date": "2022/05/26", - "falsepositive": [ - "When credentials are added/removed as part of the normal working hours/workflows" - ], - "filename": "azure_app_credential_added.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-credentials", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_credential_added.yml" - ], - "tags": [ - "attack.t1098.001", - "attack.persistence" - ] - }, - "related": [ - { - "dest-uuid": "8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "cbb67ecc-fb70-4467-9350-c910bdf7c628", - "value": "Added Credentials to Existing Application" - }, - { - "description": "Identifies when a device or device configuration in azure is modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/03", - "falsepositive": [ - "Device or device configuration being modified or deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_device_or_configuration_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#core-directory", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_device_or_configuration_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.t1485", - "attack.t1565.001" - ] - }, - "related": [ - { - "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "46530378-f9db-4af9-a9e5-889c177d3881", - "value": "Azure Device or Configuration Modified or Deleted" - }, - { - "description": "Identifies when a application is deleted in Azure.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/03", - "falsepositive": [ - "Application being deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_application_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_application_deleted.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.impact", - "attack.t1489" - ] - }, - "related": [ - { - "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "410d2a41-1e6d-452f-85e5-abdd8257a823", - "value": "Azure Application Deleted" - }, - { - "description": "Detects when a user has been elevated to manage all Azure Subscriptions.\nThis change should be investigated immediately if it isn't planned.\nThis setting could allow an attacker access to Azure subscriptions in your environment.\n", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/11/26", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_subscription_permissions_elevation_via_activitylogs.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_subscription_permissions_elevation_via_activitylogs.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "09438caa-07b1-4870-8405-1dbafe3dad95", - "value": "Azure Subscription Permission Elevation Via ActivityLogs" - }, - { - "description": "Identifies when a Firewall Rule Configuration is Modified or Deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "Firewall Rule Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Firewall Rule Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_network_firewall_rule_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_network_firewall_rule_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "2a7d64cf-81fa-4daf-ab1b-ab80b789c067", - "value": "Azure Firewall Rule Configuration Modified or Deleted" - }, - { - "description": "Detects when a Azure Kubernetes Cluster is created or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/07", - "falsepositive": [ - "Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_cluster_created_or_deleted.yml", - "level": "low", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", - "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", - "https://attack.mitre.org/matrices/enterprise/cloud/", - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_cluster_created_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "9541f321-7cba-4b43-80fc-fbd1fb922808", - "value": "Azure Kubernetes Cluster Created or Deleted" - }, - { - "description": "Detects when a user is removed from a privileged role. Bulk changes should be investigated.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/08/05", - "falsepositive": [ - "Legtimate administrator actions of removing members from a role" - ], - "filename": "azure_priviledged_role_assignment_bulk_change.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_priviledged_role_assignment_bulk_change.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1098" - ] - }, - "related": [ - { - "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "102e11e3-2db5-4c9e-bc26-357d42585d21", - "value": "Bulk Deletion Changes To Privileged Account Permissions" - }, - { - "description": "Identifies when a network security configuration is modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_network_security_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_network_security_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "d22b4df4-5a67-4859-a578-8c9a0b5af9df", - "value": "Azure Network Security Configuration Modified or Deleted" - }, - { - "description": "Detects when a user is added to a privileged role.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/08/06", - "falsepositive": [ - "Legtimate administrator actions of adding members from a role" - ], - "filename": "azure_priviledged_role_assignment_add.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_priviledged_role_assignment_add.yml" - ], - "tags": [ - "attack.privilege_escalation", - "attack.defense_evasion", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "49a268a4-72f4-4e38-8a7b-885be690c5b5", - "value": "User Added To Privilege Role" - }, - { - "description": "Number of VM creations or deployment activities occur in Azure via the azureactivity log.", - "meta": { - "author": "sawwinnnaung", - "creation_date": "2020/05/07", - "falsepositive": [ - "Valid change" - ], - "filename": "azure_creating_number_of_resources_detection.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_creating_number_of_resources_detection.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1098" - ] - }, - "related": [ - { - "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "d2d901db-7a75-45a1-bc39-0cbf00812192", - "value": "Number Of Resource Creation Or Deployment Activities" - }, - { - "description": "Detects when successful sign-ins increased by 10% or greater.", - "meta": { - "author": "Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton", - "creation_date": "2022/08/11", - "falsepositive": [ - "Increase of users in the environment" - ], - "filename": "azure_ad_auth_sucess_increase.yml", - "level": "low", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_auth_sucess_increase.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "67d5f8fc-8325-44e4-8f5f-7c0ac07cb5ae", - "value": "Measurable Increase Of Successful Authentications" - }, - { - "description": "Detect successful authentications from countries you do not operate out of.", - "meta": { - "author": "MikeDuddington, '@dudders1'", - "creation_date": "2022/07/28", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1078.004", - "attack.t1110" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "8c944ecb-6970-4541-8496-be554b8e2846", - "value": "Successful Authentications From Countries You Do Not Operate Out Of" - }, - { - "description": "Identifies when a virtual network device is being modified or deleted.\nThis can be a network interface, network virtual appliance, virtual hub, or virtual router.\n", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_network_virtual_device_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_network_virtual_device_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "15ef3fac-f0f0-4dc4-ada0-660aa72980b3", - "value": "Azure Virtual Network Device Modified or Deleted" - }, - { - "description": "Identifies when a Firewall Policy is Modified or Deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/02", - "falsepositive": [ - "Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_network_firewall_policy_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_network_firewall_policy_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.defense_evasion", - "attack.t1562.007" - ] - }, - "related": [ - { - "dest-uuid": "77532a55-c283-4cd2-bc5d-2d0b65e9d88c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "83c17918-746e-4bd9-920b-8e098bf88c23", - "value": "Azure Network Firewall Policy Modified or Deleted" - }, - { - "description": "Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.", - "meta": { - "author": "Harjot Singh, '@cyb3rjy0t'", - "creation_date": "2023/03/20", - "falsepositive": [ - "Known Legacy Accounts" - ], - "filename": "azure_ad_suspicious_signin_bypassing_mfa.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://blooteem.com/march-2022", - "https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_suspicious_signin_bypassing_mfa.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1078.004", - "attack.t1110" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc", - "value": "Potential MFA Bypass Using Legacy Client Authentication" - }, - { - "description": "Identifies when a service principal was removed in Azure.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/03", - "falsepositive": [ - "Service principal being removed may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_service_principal_removed.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_service_principal_removed.yml" - ], - "tags": [ - "attack.defense_evasion" - ] - }, - "uuid": "448fd1ea-2116-4c62-9cde-a92d120e0f08", - "value": "Azure Service Principal Removed" - }, - { - "description": "Monitor and alert for device registration or join events where MFA was not performed.", - "meta": { - "author": "Michael Epping, '@mepples21'", - "creation_date": "2022/06/28", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_device_registration_or_join_without_mfa.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#device-registrations-and-joins-outside-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_device_registration_or_join_without_mfa.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "5afa454e-030c-4ab4-9253-a90aa7fcc581", - "value": "Device Registration or Join Without MFA" - }, - { - "description": "Identifies when a new cloudshell is created inside of Azure portal.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/09/21", - "falsepositive": [ - "A new cloudshell may be created by a system administrator." - ], - "filename": "azure_new_cloudshell_created.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_new_cloudshell_created.yml" - ], - "tags": [ - "attack.execution", - "attack.t1059" - ] - }, - "related": [ - { - "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "72af37e2-ec32-47dc-992b-bc288a2708cb", - "value": "Azure New CloudShell Created" - }, - { - "description": "Identifies when a application credential is modified.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/02", - "falsepositive": [ - "Application credential added may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Application credential added from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_app_credential_modification.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.cloud-architekt.net/auditing-of-msi-and-service-principals/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_credential_modification.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "cdeef967-f9a1-4375-90ee-6978c5f23974", - "value": "Azure Application Credential Modified" - }, - { - "description": "Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD", - "meta": { - "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", - "creation_date": "2022/07/10", - "falsepositive": [ - "When the permission is legitimately needed for the app" - ], - "filename": "azure_app_permissions_msft.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_permissions_msft.yml" - ], - "tags": [ - "attack.credential_access", - "attack.t1528" - ] - }, - "related": [ - { - "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "c1d147ae-a951-48e5-8b41-dcd0170c7213", - "value": "App Granted Microsoft Permissions" - }, - { - "description": "Monitor and alert on conditional access changes where non approved actor removed CA Policy.", - "meta": { - "author": "Corissa Koopmans, '@corissalea'", - "creation_date": "2022/07/19", - "falsepositive": [ - "Misconfigured role permissions", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment." - ], - "filename": "azure_aad_secops_ca_policy_removedby_bad_actor.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_aad_secops_ca_policy_removedby_bad_actor.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.persistence", - "attack.t1548", - "attack.t1556" - ] - }, - "related": [ - { - "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "26e7c5e2-6545-481e-b7e6-050143459635", - "value": "CA Policy Removed by Non Approved Actor" - }, - { - "description": "This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.\nA threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.\nThe health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.\n", - "meta": { - "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC", - "creation_date": "2021/08/26", - "falsepositive": [ - "Legitimate AAD Health AD FS service instances being deleted in a tenant" - ], - "filename": "azure_aadhybridhealth_adfs_service_delete.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://o365blog.com/post/hybridhealthagent/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_aadhybridhealth_adfs_service_delete.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1578.003" - ] - }, - "related": [ - { - "dest-uuid": "70857657-bd0b-4695-ad3e-b13f92cac1b4", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "48739819-8230-4ee3-a8ea-e0289d1fb0ff", - "value": "Azure Active Directory Hybrid Health AD FS Service Delete" - }, - { - "description": "Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions", - "meta": { - "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", - "creation_date": "2022/07/28", - "falsepositive": [ - "When the permission is legitimately needed for the app" - ], - "filename": "azure_app_privileged_permissions.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_privileged_permissions.yml" - ], - "tags": [ - "attack.persistence", - "attack.privilege_escalation", - "attack.t1098.003" - ] - }, - "related": [ - { - "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "5aecf3d5-f8a0-48e7-99be-3a759df7358f", - "value": "App Granted Privileged Delegated Or App Permissions" - }, - { - "description": "Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.", - "meta": { - "author": "Austin Songer", - "creation_date": "2021/08/16", - "falsepositive": [ - "Suppression Rule being created may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_suppression_rule_created.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_suppression_rule_created.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "92cc3e5d-eb57-419d-8c16-5c63f325a401", - "value": "Azure Suppression Rule Created" - }, - { - "description": "Monitor and alert on conditional access changes.", - "meta": { - "author": "Corissa Koopmans, '@corissalea'", - "creation_date": "2022/07/18", - "falsepositive": [ - "Misconfigured role permissions", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment." - ], - "filename": "azure_aad_secops_new_ca_policy_addedby_bad_actor.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1548" - ] - }, - "related": [ - { - "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "0922467f-db53-4348-b7bf-dee8d0d348c6", - "value": "New CA Policy by Non-approved Actor" - }, - { - "description": "Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.", - "meta": { - "author": "Janantha Marasinghe", - "creation_date": "2022/11/27", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_azurehound_discovery.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://github.com/BloodHoundAD/AzureHound", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_azurehound_discovery.yml" - ], - "tags": [ - "attack.discovery", - "attack.t1087.004", - "attack.t1526" - ] - }, - "related": [ - { - "dest-uuid": "8f104855-e5b7-4077-b1f5-bc3103b41abe", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "e24fcba8-2557-4442-a139-1ee2f2e784db", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "35b781cc-1a08-4a5a-80af-42fd7c315c6b", - "value": "Discovery Using AzureHound" - }, - { - "description": "Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare \"old\" vs \"new\" value.", - "meta": { - "author": "Corissa Koopmans, '@corissalea'", - "creation_date": "2022/07/19", - "falsepositive": [ - "Misconfigured role permissions", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment." - ], - "filename": "azure_aad_secops_ca_policy_updatedby_bad_actor.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_aad_secops_ca_policy_updatedby_bad_actor.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.persistence", - "attack.t1548", - "attack.t1556" - ] - }, - "related": [ - { - "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "50a3c7aa-ec29-44a4-92c1-fce229eef6fc", - "value": "CA Policy Updated by Non Approved Actor" - }, - { - "description": "Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.", - "meta": { - "author": "AlertIQ", - "creation_date": "2021/10/10", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_account_lockout.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_account_lockout.yml" - ], - "tags": [ - "attack.credential_access", - "attack.t1110" - ] - }, - "related": [ - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a", - "value": "Account Lockout" - }, - { - "description": "Detects when changes are made to PIM roles", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/08/09", - "falsepositive": [ - "Legit administrative PIM setting configuration changes" - ], - "filename": "azure_pim_change_settings.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_pim_change_settings.yml" - ], - "tags": [ - "attack.privilege_escalation", - "attack.persistence", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "db6c06c4-bf3b-421c-aa88-15672b88c743", - "value": "Changes To PIM Settings" - }, - { - "description": "Monitor and alert for users added to device admin roles.", - "meta": { - "author": "Michael Epping, '@mepples21'", - "creation_date": "2022/06/28", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_users_added_to_device_admin_roles.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#device-administrator-roles", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_users_added_to_device_admin_roles.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.privilege_escalation", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "11c767ae-500b-423b-bae3-b234450736ed", - "value": "Users Added to Global or Device Admin Roles" - }, - { - "description": "This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.\nA threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.\nThis can be done programmatically via HTTP requests to Azure.\n", - "meta": { - "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC", - "creation_date": "2021/08/26", - "falsepositive": [ - "Legitimate AD FS servers added to an AAD Health AD FS service instance" - ], - "filename": "azure_aadhybridhealth_adfs_new_server.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://o365blog.com/post/hybridhealthagent/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_aadhybridhealth_adfs_new_server.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1578" - ] - }, - "related": [ - { - "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "288a39fc-4914-4831-9ada-270e9dc12cb4", - "value": "Azure Active Directory Hybrid Health AD FS New Server" - }, - { - "description": "Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.", - "meta": { - "author": "Michael Epping, '@mepples21'", - "creation_date": "2022/06/28", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_sign_ins_from_unknown_devices.yml", - "level": "low", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_sign_ins_from_unknown_devices.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "4d136857-6a1a-432a-82fc-5dd497ee5e7c", - "value": "Sign-ins by Unknown Devices" - }, - { - "description": "Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.", - "meta": { - "author": "AlertIQ", - "creation_date": "2021/10/10", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_mfa_interrupted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_mfa_interrupted.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1078.004", - "attack.t1110", - "attack.t1621" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "954a1639-f2d6-407d-aef3-4917622ca493", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "5496ff55-42ec-4369-81cb-00f417029e25", - "value": "Multifactor Authentication Interrupted" - }, - { - "description": "Detects the change of user type from \"Guest\" to \"Member\" for potential elevation of privilege.", - "meta": { - "author": "MikeDuddington, '@dudders1'", - "creation_date": "2022/06/30", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_guest_to_member.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-external-user-sign-ins", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_guest_to_member.yml" - ], - "tags": [ - "attack.privilege_escalation", - "attack.initial_access", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "8dee7a0d-43fd-4b3c-8cd1-605e189d195e", - "value": "User State Changed From Guest To Member" - }, - { - "description": "Identifies when a owner is was removed from a application or service principal in Azure.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/03", - "falsepositive": [ - "Owner being removed may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_owner_removed_from_application_or_service_principal.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_owner_removed_from_application_or_service_principal.yml" - ], - "tags": [ - "attack.defense_evasion" - ] - }, - "uuid": "636e30d5-3736-42ea-96b1-e6e2f8429fd6", - "value": "Azure Owner Removed From Application or Service Principal" - }, - { - "description": "User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.", - "meta": { - "author": "AlertIQ", - "creation_date": "2022/03/24", - "falsepositive": [ - "Users actually login but miss-click into the Deny button when MFA prompt." - ], - "filename": "azure_mfa_denies.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_mfa_denies.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1078.004", - "attack.t1110", - "attack.t1621" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "954a1639-f2d6-407d-aef3-4917622ca493", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "e40f4962-b02b-4192-9bfe-245f7ece1f99", - "value": "Multifactor Authentication Denied" - }, - { - "description": "Detects when PIM alerts are set to disabled.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/08/09", - "falsepositive": [ - "Administrator disabling PIM alerts as an active choice." - ], - "filename": "azure_pim_alerts_disabled.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_pim_alerts_disabled.yml" - ], - "tags": [ - "attack.persistence", - "attack.privilege_escalation", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "aeaef14c-e5bf-4690-a9c8-835caad458bd", - "value": "PIM Alert Setting Changes To Disabled" - }, - { - "description": "Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.", - "meta": { - "author": "sawwinnnaung", - "creation_date": "2020/05/07", - "falsepositive": [ - "Valid change" - ], - "filename": "azure_granting_permission_detection.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_granting_permission_detection.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1098.003" - ] - }, - "related": [ - { - "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "a622fcd2-4b5a-436a-b8a2-a4171161833c", - "value": "Granting Of Permissions To An Account" - }, - { - "description": "Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/07", - "falsepositive": [ - "Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_secret_or_config_object_access.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", - "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", - "https://attack.mitre.org/matrices/enterprise/cloud/", - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_secret_or_config_object_access.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "7ee0b4aa-d8d4-4088-b661-20efdf41a04c", - "value": "Azure Kubernetes Secret or Config Object Access" - }, - { - "description": "Detects when a configuration change is made to an applications URI.\nURIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.\n", - "meta": { - "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", - "creation_date": "2022/06/02", - "falsepositive": [ - "When and administrator is making legitimate URI configuration changes to an application. This should be a planned event." - ], - "filename": "azure_app_uri_modifications.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-configuration-changes", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_uri_modifications.yml" - ], - "tags": [ - "attack.t1528", - "attack.t1078.004", - "attack.persistence", - "attack.credential_access", - "attack.privilege_escalation" - ] - }, - "related": [ - { - "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "0055ad1f-be85-4798-83cf-a6da17c993b3", - "value": "Application URI Configuration Changes" - }, - { - "description": "Identifies when ClusterRoles/Roles are being modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/07", - "falsepositive": [ - "ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_role_access.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", - "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", - "https://attack.mitre.org/matrices/enterprise/cloud/", - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_role_access.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "818fee0c-e0ec-4e45-824e-83e4817b0887", - "value": "Azure Kubernetes Sensitive Role Access" - }, - { - "description": "Identifies when a Keyvault Key is modified or deleted in Azure.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/16", - "falsepositive": [ - "Key being modified or deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_keyvault_key_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_keyvault_key_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.credential_access", - "attack.t1552", - "attack.t1552.001" - ] - }, - "related": [ - { - "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "80eeab92-0979-4152-942d-96749e11df40", - "value": "Azure Keyvault Key Modified or Deleted" - }, - { - "description": "Identifies when a VPN connection is modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "VPN Connection being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "VPN Connection modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_vpn_connection_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_vpn_connection_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "61171ffc-d79c-4ae5-8e10-9323dba19cd3", - "value": "Azure VPN Connection Modified or Deleted" - }, - { - "description": "Detect failed authentications from countries you do not operate out of.", - "meta": { - "author": "MikeDuddington, '@dudders1'", - "creation_date": "2022/07/28", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml", - "level": "low", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1078.004", - "attack.t1110" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "28870ae4-6a13-4616-bd1a-235a7fad7458", - "value": "Failed Authentications From Countries You Do Not Operate Out Of" - }, - { - "description": "Detects when a configuration change is made to an applications AppID URI.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", - "creation_date": "2022/06/02", - "falsepositive": [ - "When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event." - ], - "filename": "azure_app_appid_uri_changes.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#appid-uri-added-modified-or-removed", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_appid_uri_changes.yml" - ], - "tags": [ - "attack.persistence", - "attack.credential_access", - "attack.privilege_escalation", - "attack.t1552", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "1b45b0d1-773f-4f23-aedc-814b759563b1", - "value": "Application AppID Uri Configuration Changes" - }, - { - "description": "Detects when a Container Registry is created or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/07", - "falsepositive": [ - "Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_container_registry_created_or_deleted.yml", - "level": "low", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", - "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", - "https://attack.mitre.org/matrices/enterprise/cloud/", - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_container_registry_created_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "93e0ef48-37c8-49ed-a02c-038aab23628e", - "value": "Azure Container Registry Created or Deleted" - }, - { - "description": "Detect failed attempts to sign in to disabled accounts.", - "meta": { - "author": "AlertIQ", - "creation_date": "2021/10/10", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_login_to_disabled_account.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_login_to_disabled_account.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "908655e0-25cf-4ae1-b775-1c8ce9cf43d8", - "value": "Login to Disabled Account" - }, - { - "description": "Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/07/24", - "falsepositive": [ - "Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_events_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_events_deleted.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1562", - "attack.t1562.001" - ] - }, - "related": [ - { - "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "225d8b09-e714-479c-a0e4-55e6f29adf35", - "value": "Azure Kubernetes Events Deleted" - }, - { - "description": "User Added to an Administrator's Azure AD Role", - "meta": { - "author": "Raphaël CALVET, @MetallicHack", - "creation_date": "2021/10/04", - "falsepositive": [ - "PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled." - ], - "filename": "azure_ad_user_added_to_admin_role.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_user_added_to_admin_role.yml" - ], - "tags": [ - "attack.persistence", - "attack.privilege_escalation", - "attack.t1098.003", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "ebbeb024-5b1d-4e16-9c0c-917f86c708a7", - "value": "User Added to an Administrator's Azure AD Role" - }, - { - "description": "Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.\nKubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.\nAn Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.\n", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/11/22", - "falsepositive": [ - "Azure Kubernetes CronJob/Job may be done by a system administrator.", - "If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_cronjob.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://kubernetes.io/docs/concepts/workloads/controllers/job/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_cronjob.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1053.003", - "attack.privilege_escalation", - "attack.execution" - ] - }, - "related": [ - { - "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "1c71e254-6655-42c1-b2d6-5e4718d7fc0a", - "value": "Azure Kubernetes CronJob" - }, - { - "description": "Detects guest users being invited to tenant by non-approved inviters", - "meta": { - "author": "MikeDuddington, '@dudders1'", - "creation_date": "2022/07/28", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-external-user-sign-ins", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "4ad97bf5-a514-41a4-abd3-4f3455ad4865", - "value": "Guest Users Invited To Tenant By Non Approved Inviters" - }, - { - "description": "Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/08/09", - "falsepositive": [ - "Actual admin using PIM." - ], - "filename": "azure_pim_activation_approve_deny.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_pim_activation_approve_deny.yml" - ], - "tags": [ - "attack.privilege_escalation", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "039a7469-0296-4450-84c0-f6966b16dc6d", - "value": "PIM Approvals And Deny Elevation" - }, - { - "description": "Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/07", - "falsepositive": [ - "RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_rolebinding_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", - "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", - "https://attack.mitre.org/matrices/enterprise/cloud/", - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_rolebinding_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.credential_access" - ] - }, - "uuid": "25cb259b-bbdc-4b87-98b7-90d7c72f8743", - "value": "Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted" - }, - { - "description": "Detects when highly privileged delegated permissions are granted on behalf of all users", - "meta": { - "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", - "creation_date": "2022/07/28", - "falsepositive": [ - "When the permission is legitimately needed for the app" - ], - "filename": "azure_app_delegated_permissions_all_users.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_delegated_permissions_all_users.yml" - ], - "tags": [ - "attack.credential_access", - "attack.t1528" - ] - }, - "related": [ - { - "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "a6355fbe-f36f-45d8-8efc-ab42465cbc52", - "value": "Delegated Permissions Granted For All Users" - }, - { - "description": "Identifies when a firewall is created, modified, or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "Firewall being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Firewall modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_firewall_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_firewall_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.defense_evasion", - "attack.t1562.004" - ] - }, - "related": [ - { - "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "512cf937-ea9b-4332-939c-4c2c94baadcd", - "value": "Azure Firewall Modified or Deleted" - }, - { - "description": "Detects risky authencaition from a non AD registered device without MFA being required.", - "meta": { - "author": "Harjot Singh, '@cyb3rjy0t'", - "creation_date": "2023/01/10", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "572b12d4-9062-11ed-a1eb-0242ac120002", - "value": "Suspicious SignIns From A Non Registered Device" - }, - { - "description": "Identifies when DNS zone is modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_dns_zone_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_dns_zone_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.t1565.001" - ] - }, - "related": [ - { - "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "af6925b0-8826-47f1-9324-337507a0babd", - "value": "Azure DNS Zone Modified or Deleted" - }, - { - "description": "Identifies when a Virtual Network is modified or deleted in Azure.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "Virtual Network being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Virtual Network modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_virtual_network_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_virtual_network_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "bcfcc962-0e4a-4fd9-84bb-a833e672df3f", - "value": "Azure Virtual Network Modified or Deleted" - }, - { - "description": "Monitor and alert for changes to the device registration policy.", - "meta": { - "author": "Michael Epping, '@mepples21'", - "creation_date": "2022/06/28", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_device_registration_policy_changes.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#device-registrations-and-joins-outside-policy", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_device_registration_policy_changes.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.privilege_escalation", - "attack.t1484" - ] - }, - "related": [ - { - "dest-uuid": "ebb42bbe-62d7-47d7-a55f-3b08b61d792d", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "9494bff8-959f-4440-bbce-fb87a208d517", - "value": "Changes to Device Registration Policy" - }, - { - "description": "Detect when users are authenticating without MFA being required.", - "meta": { - "author": "MikeDuddington, '@dudders1'", - "creation_date": "2022/07/27", - "falsepositive": [ - "If this was approved by System Administrator." - ], - "filename": "azure_ad_only_single_factor_auth_required.yml", - "level": "low", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_only_single_factor_auth_required.yml" - ], - "tags": [ - "attack.initial_access", - "attack.credential_access", - "attack.t1078.004", - "attack.t1556.006" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "b4409cd8-0da9-46e1-a401-a241afd4d1cc", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "28eea407-28d7-4e42-b0be-575d5ba60b2c", - "value": "Azure AD Only Single Factor Authentication Required" - }, - { - "description": "Monitor and alert for sign-ins where the device was non-compliant.", - "meta": { - "author": "Michael Epping, '@mepples21'", - "creation_date": "2022/06/28", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_ad_sign_ins_from_noncompliant_devices.yml", - "level": "high", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_ad_sign_ins_from_noncompliant_devices.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "4f77e1d7-3982-4ee0-8489-abf2d6b75284", - "value": "Sign-ins from Non-Compliant Devices" - }, - { - "description": "Detects when a new admin is created.", - "meta": { - "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton", - "creation_date": "2022/08/11", - "falsepositive": [ - "A legitimate new admin account being created" - ], - "filename": "azure_privileged_account_creation.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_privileged_account_creation.yml" - ], - "tags": [ - "attack.persistence", - "attack.privilege_escalation", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "f7b5b004-dece-46e4-a4a5-f6fd0e1c6947", - "value": "Privileged Account Creation" - }, - { - "description": "Identifies when a device in azure is no longer managed or compliant", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/09/03", - "falsepositive": [ - "Administrator may have forgotten to review the device." - ], - "filename": "azure_device_no_longer_managed_or_compliant.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#core-directory", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_device_no_longer_managed_or_compliant.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "542b9912-c01f-4e3f-89a8-014c48cdca7d", - "value": "Azure Device No Longer Managed or Compliant" - }, - { - "description": "Monitor and alert on group membership removal of groups that have CA policy modification access", - "meta": { - "author": "Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'", - "creation_date": "2022/08/04", - "falsepositive": [ - "User removed from the group is approved" - ], - "filename": "azure_group_user_removal_ca_modification.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_group_user_removal_ca_modification.yml" - ], - "tags": [ - "attack.defense_evasion", - "attack.persistence", - "attack.t1548", - "attack.t1556" - ] - }, - "related": [ - { - "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "665e2d43-70dc-4ccc-9d27-026c9dd7ed9c", - "value": "User Removed From Group With CA Policy Modification Access" - }, - { - "description": "Detects when there is a interruption in the authentication process.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/11/26", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_unusual_authentication_interruption.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_unusual_authentication_interruption.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "8366030e-7216-476b-9927-271d79f13cf3", - "value": "Azure Unusual Authentication Interruption" - }, - { - "description": "Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.", - "meta": { - "author": "@ionsor", - "creation_date": "2022/02/08", - "falsepositive": [ - "Authorized modification by administrators" - ], - "filename": "azure_mfa_disabled.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_mfa_disabled.yml" - ], - "tags": [ - "attack.persistence", - "attack.t1556" - ] - }, - "related": [ - { - "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "7ea78478-a4f9-42a6-9dcd-f861816122bf", - "value": "Disabled MFA to Bypass Authentication Mechanisms" - }, - { - "description": "Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.\nIf this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.\nThis can be a misconfigured application or potentially something malicious.\n", - "meta": { - "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", - "creation_date": "2022/06/01", - "falsepositive": [ - "Applications that are input constrained will need to use device code flow and are valid authentications." - ], - "filename": "azure_app_device_code_authentication.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-authentication-flows", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_device_code_authentication.yml" - ], - "tags": [ - "attack.t1078", - "attack.defense_evasion", - "attack.persistence", - "attack.privilege_escalation", - "attack.initial_access" - ] - }, - "related": [ - { - "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "248649b7-d64f-46f0-9fb2-a52774166fb5", - "value": "Application Using Device Code Authentication Flow" - }, - { - "description": "Detects when end user consent is blocked due to risk-based consent.", - "meta": { - "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", - "creation_date": "2022/07/10", - "falsepositive": [ - "Unknown" - ], - "filename": "azure_app_end_user_consent_blocked.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#end-user-stopped-due-to-risk-based-consent", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_app_end_user_consent_blocked.yml" - ], - "tags": [ - "attack.credential_access", - "attack.t1528" - ] - }, - "related": [ - { - "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "7091372f-623c-4293-bc37-20c32b3492be", - "value": "End User Consent Blocked" - }, - { - "description": "Detects when an account is disabled or blocked for sign in but tried to log in", - "meta": { - "author": "Yochana Henderson, '@Yochana-H'", - "creation_date": "2022/06/17", - "falsepositive": [ - "Account disabled or blocked in error", - "Automation account has been blocked or disabled" - ], - "filename": "azure_blocked_account_attempt.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-privileged-accounts", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_blocked_account_attempt.yml" - ], - "tags": [ - "attack.initial_access", - "attack.t1078.004" - ] - }, - "related": [ - { - "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "4afac85c-224a-4dd7-b1af-8da40e1c60bd", - "value": "Account Disabled or Blocked for Sign in Attempts" - }, - { - "description": "Identifies when a Point-to-site VPN is Modified or Deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/08", - "falsepositive": [ - "Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_network_p2s_vpn_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_network_p2s_vpn_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact" - ] - }, - "uuid": "d9557b75-267b-4b43-922f-a775e2d1f792", - "value": "Azure Point-to-site VPN Modified or Deleted" - }, - { - "description": "Identifies when secrets are modified or deleted in Azure.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/16", - "falsepositive": [ - "Secrets being modified or deleted may be performed by a system administrator.", - "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_keyvault_secrets_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_keyvault_secrets_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.credential_access", - "attack.t1552", - "attack.t1552.001" - ] - }, - "related": [ - { - "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - }, - { - "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "b831353c-1971-477b-abb6-2828edc3bca1", - "value": "Azure Keyvault Secrets Modified or Deleted" - }, - { - "description": "Identifies when a Azure Kubernetes network policy is modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/07", - "falsepositive": [ - "Network Policy being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Network Policy being modified and deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_network_policy_change.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", - "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", - "https://attack.mitre.org/matrices/enterprise/cloud/", - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_network_policy_change.yml" - ], - "tags": [ - "attack.impact", - "attack.credential_access" - ] - }, - "uuid": "08d6ac24-c927-4469-b3b7-2e422d6e3c43", - "value": "Azure Kubernetes Network Policy Change" - }, - { - "description": "Identifies when a service account is modified or deleted.", - "meta": { - "author": "Austin Songer @austinsonger", - "creation_date": "2021/08/07", - "falsepositive": [ - "Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", - "Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." - ], - "filename": "azure_kubernetes_service_account_modified_or_deleted.yml", - "level": "medium", - "logsource.category": "No established category", - "logsource.product": "azure", - "refs": [ - "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", - "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", - "https://attack.mitre.org/matrices/enterprise/cloud/", - "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", - "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", - "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/azure_kubernetes_service_account_modified_or_deleted.yml" - ], - "tags": [ - "attack.impact", - "attack.t1531" - ] - }, - "related": [ - { - "dest-uuid": "b24e2a20-3b3d-4bf0-823b-1ed765398fb0", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "related-to" - } - ], - "uuid": "12d027c3-b48c-4d9d-8bb6-a732200034b2", - "value": "Azure Kubernetes Service Account Modified or Deleted" - }, { "description": "Identifies an event where there are there are too many accounts assigned the Global Administrator role.", "meta": { @@ -87366,6 +84162,913 @@ "uuid": "e402c26a-267a-45bd-9615-bd9ceda6da85", "value": "Stale Accounts In A Privileged Role" }, + { + "description": "Alert on when legecy authentication has been used on an account", + "meta": { + "author": "Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/06/17", + "falsepositive": [ + "User has been put in acception group so they can use legacy authentication" + ], + "filename": "azure_legacy_authentication_protocols.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_legacy_authentication_protocols.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1078.004", + "attack.t1110" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "60f6535a-760f-42a9-be3f-c9a0a025906e", + "value": "Use of Legacy Authentication Protocols" + }, + { + "description": "Define a baseline threshold for failed sign-ins due to Conditional Access failures", + "meta": { + "author": "Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/06/01", + "falsepositive": [ + "Service Account misconfigured", + "Misconfigured Systems", + "Vulnerability Scanners" + ], + "filename": "azure_conditional_access_failure.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_conditional_access_failure.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1110", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "b4a6d707-9430-4f5f-af68-0337f52d5c42", + "value": "Sign-in Failure Due to Conditional Access Requirements Not Met" + }, + { + "description": "Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly.\nThe application then uses those credentials to authenticate the user against the identity provider.\n", + "meta": { + "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", + "creation_date": "2022/06/01", + "falsepositive": [ + "Applications that are being used as part of automated testing or a legacy application that cannot use any other modern authentication flow" + ], + "filename": "azure_app_ropc_authentication.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-authentication-flows", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_app_ropc_authentication.yml" + ], + "tags": [ + "attack.t1078", + "attack.defense_evasion", + "attack.persistence", + "attack.privilege_escalation", + "attack.initial_access" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "55695bc0-c8cf-461f-a379-2535f563c854", + "value": "Applications That Are Using ROPC Authentication Flow" + }, + { + "description": "Detect access has been blocked by Conditional Access policies.\nThe access policy does not allow token issuance which might be sights≈ of unauthorizeed login to valid accounts.\n", + "meta": { + "author": "AlertIQ", + "creation_date": "2021/10/10", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_user_login_blocked_by_conditional_access.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_user_login_blocked_by_conditional_access.yml" + ], + "tags": [ + "attack.credential_access", + "attack.initial_access", + "attack.t1110", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "9a60e676-26ac-44c3-814b-0c2a8b977adf", + "value": "User Access Blocked by Azure Conditional Access" + }, + { + "description": "Detects when sign-ins increased by 10% or greater.", + "meta": { + "author": "Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'", + "creation_date": "2022/08/11", + "falsepositive": [ + "Unlikely" + ], + "filename": "azure_ad_auth_failure_increase.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_auth_failure_increase.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "e1d02b53-c03c-4948-b11d-4d00cca49d03", + "value": "Increased Failed Authentications Of Any Type" + }, + { + "description": "Detect when users in your Azure AD tenant are authenticating to other Azure AD Tenants.", + "meta": { + "author": "MikeDuddington, '@dudders1'", + "creation_date": "2022/06/30", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_users_authenticating_to_other_azure_ad_tenants.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-external-user-sign-ins", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_users_authenticating_to_other_azure_ad_tenants.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "5f521e4b-0105-4b72-845b-2198a54487b9", + "value": "Users Authenticating To Other Azure AD Tenants" + }, + { + "description": "Detect when authentications to important application(s) only required single-factor authentication", + "meta": { + "author": "MikeDuddington, '@dudders1'", + "creation_date": "2022/07/28", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_ad_auth_to_important_apps_using_single_factor_auth.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_auth_to_important_apps_using_single_factor_auth.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "f272fb46-25f2-422c-b667-45837994980f", + "value": "Authentications To Important Apps Using Single Factor Authentication" + }, + { + "description": "Detects when successful sign-ins increased by 10% or greater.", + "meta": { + "author": "Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton", + "creation_date": "2022/08/11", + "falsepositive": [ + "Increase of users in the environment" + ], + "filename": "azure_ad_auth_sucess_increase.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_auth_sucess_increase.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "67d5f8fc-8325-44e4-8f5f-7c0ac07cb5ae", + "value": "Measurable Increase Of Successful Authentications" + }, + { + "description": "Detect successful authentications from countries you do not operate out of.", + "meta": { + "author": "MikeDuddington, '@dudders1'", + "creation_date": "2022/07/28", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_authentications_from_countries_you_do_not_operate_out_of.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1078.004", + "attack.t1110" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "8c944ecb-6970-4541-8496-be554b8e2846", + "value": "Successful Authentications From Countries You Do Not Operate Out Of" + }, + { + "description": "Detects successful authentication from potential clients using legacy authentication via user agent strings. This could be a sign of MFA bypass using a password spray attack.", + "meta": { + "author": "Harjot Singh, '@cyb3rjy0t'", + "creation_date": "2023/03/20", + "falsepositive": [ + "Known Legacy Accounts" + ], + "filename": "azure_ad_suspicious_signin_bypassing_mfa.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://blooteem.com/march-2022", + "https://www.microsoft.com/en-us/security/blog/2021/10/26/protect-your-business-from-password-sprays-with-microsoft-dart-recommendations/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_suspicious_signin_bypassing_mfa.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1078.004", + "attack.t1110" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "53bb4f7f-48a8-4475-ac30-5a82ddfdf6fc", + "value": "Potential MFA Bypass Using Legacy Client Authentication" + }, + { + "description": "Monitor and alert for device registration or join events where MFA was not performed.", + "meta": { + "author": "Michael Epping, '@mepples21'", + "creation_date": "2022/06/28", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_device_registration_or_join_without_mfa.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#device-registrations-and-joins-outside-policy", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_device_registration_or_join_without_mfa.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "5afa454e-030c-4ab4-9253-a90aa7fcc581", + "value": "Device Registration or Join Without MFA" + }, + { + "description": "Detects AzureHound (A BloodHound data collector for Microsoft Azure) activity via the default User-Agent that is used during its operation after successful authentication.", + "meta": { + "author": "Janantha Marasinghe", + "creation_date": "2022/11/27", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_azurehound_discovery.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://github.com/BloodHoundAD/AzureHound", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_azurehound_discovery.yml" + ], + "tags": [ + "attack.discovery", + "attack.t1087.004", + "attack.t1526" + ] + }, + "related": [ + { + "dest-uuid": "8f104855-e5b7-4077-b1f5-bc3103b41abe", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "e24fcba8-2557-4442-a139-1ee2f2e784db", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "35b781cc-1a08-4a5a-80af-42fd7c315c6b", + "value": "Discovery Using AzureHound" + }, + { + "description": "Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.", + "meta": { + "author": "AlertIQ", + "creation_date": "2021/10/10", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_account_lockout.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_account_lockout.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1110" + ] + }, + "related": [ + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a", + "value": "Account Lockout" + }, + { + "description": "Monitor and alert for Sign-ins by unknown devices from non-Trusted locations.", + "meta": { + "author": "Michael Epping, '@mepples21'", + "creation_date": "2022/06/28", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_sign_ins_from_unknown_devices.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_unknown_devices.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "4d136857-6a1a-432a-82fc-5dd497ee5e7c", + "value": "Sign-ins by Unknown Devices" + }, + { + "description": "Identifies user login with multifactor authentication failures, which might be an indication an attacker has the password for the account but can't pass the MFA challenge.", + "meta": { + "author": "AlertIQ", + "creation_date": "2021/10/10", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_mfa_interrupted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_mfa_interrupted.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1078.004", + "attack.t1110", + "attack.t1621" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "954a1639-f2d6-407d-aef3-4917622ca493", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "5496ff55-42ec-4369-81cb-00f417029e25", + "value": "Multifactor Authentication Interrupted" + }, + { + "description": "User has indicated they haven't instigated the MFA prompt and could indicate an attacker has the password for the account.", + "meta": { + "author": "AlertIQ", + "creation_date": "2022/03/24", + "falsepositive": [ + "Users actually login but miss-click into the Deny button when MFA prompt." + ], + "filename": "azure_mfa_denies.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_mfa_denies.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1078.004", + "attack.t1110", + "attack.t1621" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "954a1639-f2d6-407d-aef3-4917622ca493", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "e40f4962-b02b-4192-9bfe-245f7ece1f99", + "value": "Multifactor Authentication Denied" + }, + { + "description": "Detect failed authentications from countries you do not operate out of.", + "meta": { + "author": "MikeDuddington, '@dudders1'", + "creation_date": "2022/07/28", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_failed_auth_from_countries_you_do_not_operate_out_of.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1078.004", + "attack.t1110" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "a93494bb-4b80-4ea1-8695-3236a49916fd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "28870ae4-6a13-4616-bd1a-235a7fad7458", + "value": "Failed Authentications From Countries You Do Not Operate Out Of" + }, + { + "description": "Detect failed attempts to sign in to disabled accounts.", + "meta": { + "author": "AlertIQ", + "creation_date": "2021/10/10", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_login_to_disabled_account.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_login_to_disabled_account.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "908655e0-25cf-4ae1-b775-1c8ce9cf43d8", + "value": "Login to Disabled Account" + }, + { + "description": "Detects risky authencaition from a non AD registered device without MFA being required.", + "meta": { + "author": "Harjot Singh, '@cyb3rjy0t'", + "creation_date": "2023/01/10", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_risky_sign_ins_with_singlefactorauth_from_unknown_devices.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "572b12d4-9062-11ed-a1eb-0242ac120002", + "value": "Suspicious SignIns From A Non Registered Device" + }, + { + "description": "Detect when users are authenticating without MFA being required.", + "meta": { + "author": "MikeDuddington, '@dudders1'", + "creation_date": "2022/07/27", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_ad_only_single_factor_auth_required.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_only_single_factor_auth_required.yml" + ], + "tags": [ + "attack.initial_access", + "attack.credential_access", + "attack.t1078.004", + "attack.t1556.006" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "b4409cd8-0da9-46e1-a401-a241afd4d1cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "28eea407-28d7-4e42-b0be-575d5ba60b2c", + "value": "Azure AD Only Single Factor Authentication Required" + }, + { + "description": "Monitor and alert for sign-ins where the device was non-compliant.", + "meta": { + "author": "Michael Epping, '@mepples21'", + "creation_date": "2022/06/28", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_sign_ins_from_noncompliant_devices.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#non-compliant-device-sign-in", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_ad_sign_ins_from_noncompliant_devices.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "4f77e1d7-3982-4ee0-8489-abf2d6b75284", + "value": "Sign-ins from Non-Compliant Devices" + }, + { + "description": "Detects when there is a interruption in the authentication process.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/11/26", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_unusual_authentication_interruption.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_unusual_authentication_interruption.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "8366030e-7216-476b-9927-271d79f13cf3", + "value": "Azure Unusual Authentication Interruption" + }, + { + "description": "Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments.\nIf this type of flow is seen in the environment and not being used in an input constrained device scenario, further investigation is warranted.\nThis can be a misconfigured application or potentially something malicious.\n", + "meta": { + "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", + "creation_date": "2022/06/01", + "falsepositive": [ + "Applications that are input constrained will need to use device code flow and are valid authentications." + ], + "filename": "azure_app_device_code_authentication.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-authentication-flows", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_app_device_code_authentication.yml" + ], + "tags": [ + "attack.t1078", + "attack.defense_evasion", + "attack.persistence", + "attack.privilege_escalation", + "attack.initial_access" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "248649b7-d64f-46f0-9fb2-a52774166fb5", + "value": "Application Using Device Code Authentication Flow" + }, + { + "description": "Detects when an account is disabled or blocked for sign in but tried to log in", + "meta": { + "author": "Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/06/17", + "falsepositive": [ + "Account disabled or blocked in error", + "Automation account has been blocked or disabled" + ], + "filename": "azure_blocked_account_attempt.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/signin_logs/azure_blocked_account_attempt.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "4afac85c-224a-4dd7-b1af-8da40e1c60bd", + "value": "Account Disabled or Blocked for Sign in Attempts" + }, { "description": "Indicates that a password spray attack has been successfully performed.", "meta": { @@ -87379,8 +85082,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#password-spray", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_password_spray.yml" ], "tags": [ @@ -87413,8 +85116,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#suspicious-inbox-manipulation-rules", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_manipulation.yml" ], "tags": [ @@ -87447,8 +85150,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#anonymous-ip-address", + "https://learn.microsoft.com/en-us/graph/api/resources/riskdetection?view=graph-rest-1.0", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_address.yml" ], "tags": [ @@ -87518,8 +85221,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#suspicious-inbox-forwarding", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_inbox_forwarding_rule.yml" ], "tags": [ @@ -87552,8 +85255,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#atypical-travel", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_atypical_travel.yml" ], "tags": [ @@ -87623,8 +85326,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_malware_linked_ip.yml" ], "tags": [ @@ -87691,8 +85394,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#unfamiliar-sign-in-properties", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_unfamilar_sign_in.yml" ], "tags": [ @@ -87830,8 +85533,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#anomalous-token", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_token.yml" ], "tags": [ @@ -87902,8 +85605,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#activity-from-anonymous-ip-address", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_anonymous_ip_activity.yml" ], "tags": [ @@ -88013,8 +85716,8 @@ "logsource.category": "No established category", "logsource.product": "azure", "refs": [ - "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#anomalous-user-activity", + "https://learn.microsoft.com/en-us/azure/active-directory/architecture/security-operations-user-accounts#unusual-sign-ins", "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml" ], "tags": [ @@ -88034,6 +85737,2538 @@ "uuid": "258b6593-215d-4a26-a141-c8e31c1299a6", "value": "Anomalous User Activity" }, + { + "description": "Detects when an end user consents to an application", + "meta": { + "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", + "creation_date": "2022/07/28", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_app_end_user_consent.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#end-user-consent", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_end_user_consent.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1528" + ] + }, + "related": [ + { + "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "9b2cc4c4-2ad4-416d-8e8e-ee6aa6f5035a", + "value": "End User Consent" + }, + { + "description": "Detects when an app is assigned Azure AD roles, such as global adminsitrator, or Azure RBAC roles, such as subscription owner.", + "meta": { + "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", + "creation_date": "2022/07/19", + "falsepositive": [ + "When the permission is legitimately needed for the app" + ], + "filename": "azure_app_role_added.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#service-principal-assigned-to-a-role", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_role_added.yml" + ], + "tags": [ + "attack.persistence", + "attack.privilege_escalation", + "attack.t1098.003" + ] + }, + "related": [ + { + "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "b04934b2-0a68-4845-8a19-bdfed3a68a7a", + "value": "App Role Added" + }, + { + "description": "Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.", + "meta": { + "author": "AlertIQ", + "creation_date": "2021/10/10", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_change_to_authentication_method.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1556", + "attack.persistence", + "attack.defense_evasion", + "attack.t1098" + ] + }, + "related": [ + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "4d78a000-ab52-4564-88a5-7ab5242b20c7", + "value": "Change to Authentication Method" + }, + { + "description": "Detects when a user that doesn't have permissions to invite a guest user attempts to invite one.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/08/10", + "falsepositive": [ + "A non malicious user is unaware of the proper process" + ], + "filename": "azure_guest_invite_failure.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#things-to-monitor", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_guest_invite_failure.yml" + ], + "tags": [ + "attack.persistence", + "attack.defense_evasion", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "0b4b72e3-4c53-4d5b-b198-2c58cfef39a9", + "value": "Guest User Invited By Non Approved Inviters" + }, + { + "description": "Detects when a temporary access pass (TAP) is added to an account. TAPs added to priv accounts should be investigated", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/08/10", + "falsepositive": [ + "Administrator adding a legitimate temporary access pass" + ], + "filename": "azure_tap_added.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_tap_added.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "fa84aaf5-8142-43cd-9ec2-78cfebf878ce", + "value": "Temporary Access Pass Added To An Account" + }, + { + "description": "Detects when a user has been elevated to manage all Azure Subscriptions.\nThis change should be investigated immediately if it isn't planned.\nThis setting could allow an attacker access to Azure subscriptions in your environment.\n", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/11/26", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_subscription_permissions_elevation_via_auditlogs.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#assignment-and-elevation", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_subscription_permissions_elevation_via_auditlogs.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "ca9bf243-465e-494a-9e54-bf9fc239057d", + "value": "Azure Subscription Permission Elevation Via AuditLogs" + }, + { + "description": "Detects when an account was created and deleted in a short period of time.", + "meta": { + "author": "Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton", + "creation_date": "2022/08/11", + "falsepositive": [ + "Legit administrative action" + ], + "filename": "azure_ad_account_created_deleted.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-user-accounts#short-lived-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_ad_account_created_deleted.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "6f583da0-3a90-4566-a4ed-83c09fe18bbf", + "value": "Account Created And Deleted Within A Close Time Frame" + }, + { + "description": "Monitor and alert for Bitlocker key retrieval.", + "meta": { + "author": "Michael Epping, '@mepples21'", + "creation_date": "2022/06/28", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_bitlocker_key_retrieval.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#bitlocker-key-retrieval", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_ad_bitlocker_key_retrieval.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "a0413867-daf3-43dd-9245-734b3a787942", + "value": "Bitlocker Key Retrieval" + }, + { + "description": "Detects when a new owner is added to an application. This gives that account privileges to make modifications and configuration changes to the application.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", + "creation_date": "2022/06/02", + "falsepositive": [ + "When a new application owner is added by an administrator" + ], + "filename": "azure_app_owner_added.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#new-owner", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_owner_added.yml" + ], + "tags": [ + "attack.t1552", + "attack.credential_access" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "74298991-9fc4-460e-a92e-511aa60baec1", + "value": "Added Owner To Application" + }, + { + "description": "Detect when a user has reset their password in Azure AD", + "meta": { + "author": "YochanaHenderson, '@Yochana-H'", + "creation_date": "2022/08/03", + "falsepositive": [ + "If this was approved by System Administrator or confirmed user action." + ], + "filename": "azure_user_password_change.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_user_password_change.yml" + ], + "tags": [ + "attack.persistence", + "attack.credential_access", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "340ee172-4b67-4fb4-832f-f961bdc1f3aa", + "value": "Password Reset By User Account" + }, + { + "description": "Monitor and alert on group membership additions of groups that have CA policy modification access", + "meta": { + "author": "Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'", + "creation_date": "2022/08/04", + "falsepositive": [ + "User removed from the group is approved" + ], + "filename": "azure_group_user_addition_ca_modification.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_group_user_addition_ca_modification.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.persistence", + "attack.t1548", + "attack.t1556" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "91c95675-1f27-46d0-bead-d1ae96b97cd3", + "value": "User Added To Group With CA Policy Modification Access" + }, + { + "description": "Identifies when an user or application modified the federation settings on the domain.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/09/06", + "falsepositive": [ + "Federation Settings being modified or deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Federation Settings modified from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_federation_modified.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_federation_modified.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "352a54e1-74ba-4929-9d47-8193d67aba1e", + "value": "Azure Domain Federation Settings Modified" + }, + { + "description": "Detects when a new credential is added to an existing application. Any additional credentials added outside of expected processes could be a malicious actor using those credentials.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", + "creation_date": "2022/05/26", + "falsepositive": [ + "When credentials are added/removed as part of the normal working hours/workflows" + ], + "filename": "azure_app_credential_added.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-credentials", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_credential_added.yml" + ], + "tags": [ + "attack.t1098.001", + "attack.persistence" + ] + }, + "related": [ + { + "dest-uuid": "8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "cbb67ecc-fb70-4467-9350-c910bdf7c628", + "value": "Added Credentials to Existing Application" + }, + { + "description": "Detects when a user is removed from a privileged role. Bulk changes should be investigated.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/08/05", + "falsepositive": [ + "Legtimate administrator actions of removing members from a role" + ], + "filename": "azure_priviledged_role_assignment_bulk_change.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1098" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "102e11e3-2db5-4c9e-bc26-357d42585d21", + "value": "Bulk Deletion Changes To Privileged Account Permissions" + }, + { + "description": "Detects when a user is added to a privileged role.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/08/06", + "falsepositive": [ + "Legtimate administrator actions of adding members from a role" + ], + "filename": "azure_priviledged_role_assignment_add.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_add.yml" + ], + "tags": [ + "attack.privilege_escalation", + "attack.defense_evasion", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "49a268a4-72f4-4e38-8a7b-885be690c5b5", + "value": "User Added To Privilege Role" + }, + { + "description": "Detects when an application is granted delegated or app role permissions for Microsoft Graph, Exchange, Sharepoint, or Azure AD", + "meta": { + "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", + "creation_date": "2022/07/10", + "falsepositive": [ + "When the permission is legitimately needed for the app" + ], + "filename": "azure_app_permissions_msft.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_permissions_msft.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1528" + ] + }, + "related": [ + { + "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "c1d147ae-a951-48e5-8b41-dcd0170c7213", + "value": "App Granted Microsoft Permissions" + }, + { + "description": "Monitor and alert on conditional access changes where non approved actor removed CA Policy.", + "meta": { + "author": "Corissa Koopmans, '@corissalea'", + "creation_date": "2022/07/19", + "falsepositive": [ + "Misconfigured role permissions", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment." + ], + "filename": "azure_aad_secops_ca_policy_removedby_bad_actor.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_removedby_bad_actor.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.persistence", + "attack.t1548", + "attack.t1556" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "26e7c5e2-6545-481e-b7e6-050143459635", + "value": "CA Policy Removed by Non Approved Actor" + }, + { + "description": "Detects when administrator grants either application permissions (app roles) or highly privileged delegated permissions", + "meta": { + "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", + "creation_date": "2022/07/28", + "falsepositive": [ + "When the permission is legitimately needed for the app" + ], + "filename": "azure_app_privileged_permissions.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_privileged_permissions.yml" + ], + "tags": [ + "attack.persistence", + "attack.privilege_escalation", + "attack.t1098.003" + ] + }, + "related": [ + { + "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "5aecf3d5-f8a0-48e7-99be-3a759df7358f", + "value": "App Granted Privileged Delegated Or App Permissions" + }, + { + "description": "Monitor and alert on conditional access changes.", + "meta": { + "author": "Corissa Koopmans, '@corissalea'", + "creation_date": "2022/07/18", + "falsepositive": [ + "Misconfigured role permissions", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment." + ], + "filename": "azure_aad_secops_new_ca_policy_addedby_bad_actor.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_aad_secops_new_ca_policy_addedby_bad_actor.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1548" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "0922467f-db53-4348-b7bf-dee8d0d348c6", + "value": "New CA Policy by Non-approved Actor" + }, + { + "description": "Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare \"old\" vs \"new\" value.", + "meta": { + "author": "Corissa Koopmans, '@corissalea'", + "creation_date": "2022/07/19", + "falsepositive": [ + "Misconfigured role permissions", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment." + ], + "filename": "azure_aad_secops_ca_policy_updatedby_bad_actor.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_aad_secops_ca_policy_updatedby_bad_actor.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.persistence", + "attack.t1548", + "attack.t1556" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "50a3c7aa-ec29-44a4-92c1-fce229eef6fc", + "value": "CA Policy Updated by Non Approved Actor" + }, + { + "description": "Detects when changes are made to PIM roles", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/08/09", + "falsepositive": [ + "Legit administrative PIM setting configuration changes" + ], + "filename": "azure_pim_change_settings.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_pim_change_settings.yml" + ], + "tags": [ + "attack.privilege_escalation", + "attack.persistence", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "db6c06c4-bf3b-421c-aa88-15672b88c743", + "value": "Changes To PIM Settings" + }, + { + "description": "Monitor and alert for users added to device admin roles.", + "meta": { + "author": "Michael Epping, '@mepples21'", + "creation_date": "2022/06/28", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_users_added_to_device_admin_roles.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#device-administrator-roles", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_ad_users_added_to_device_admin_roles.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.privilege_escalation", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "11c767ae-500b-423b-bae3-b234450736ed", + "value": "Users Added to Global or Device Admin Roles" + }, + { + "description": "Detects the change of user type from \"Guest\" to \"Member\" for potential elevation of privilege.", + "meta": { + "author": "MikeDuddington, '@dudders1'", + "creation_date": "2022/06/30", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_guest_to_member.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-external-user-sign-ins", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_guest_to_member.yml" + ], + "tags": [ + "attack.privilege_escalation", + "attack.initial_access", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "8dee7a0d-43fd-4b3c-8cd1-605e189d195e", + "value": "User State Changed From Guest To Member" + }, + { + "description": "Detects when PIM alerts are set to disabled.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/08/09", + "falsepositive": [ + "Administrator disabling PIM alerts as an active choice." + ], + "filename": "azure_pim_alerts_disabled.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_pim_alerts_disabled.yml" + ], + "tags": [ + "attack.persistence", + "attack.privilege_escalation", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "aeaef14c-e5bf-4690-a9c8-835caad458bd", + "value": "PIM Alert Setting Changes To Disabled" + }, + { + "description": "Detects when a configuration change is made to an applications URI.\nURIs for domain names that no longer exist (dangling URIs), not using HTTPS, wildcards at the end of the domain, URIs that are no unique to that app, or URIs that point to domains you do not control should be investigated.\n", + "meta": { + "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", + "creation_date": "2022/06/02", + "falsepositive": [ + "When and administrator is making legitimate URI configuration changes to an application. This should be a planned event." + ], + "filename": "azure_app_uri_modifications.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-configuration-changes", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_uri_modifications.yml" + ], + "tags": [ + "attack.t1528", + "attack.t1078.004", + "attack.persistence", + "attack.credential_access", + "attack.privilege_escalation" + ] + }, + "related": [ + { + "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "0055ad1f-be85-4798-83cf-a6da17c993b3", + "value": "Application URI Configuration Changes" + }, + { + "description": "Detects when a configuration change is made to an applications AppID URI.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'", + "creation_date": "2022/06/02", + "falsepositive": [ + "When and administrator is making legitimate AppID URI configuration changes to an application. This should be a planned event." + ], + "filename": "azure_app_appid_uri_changes.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#appid-uri-added-modified-or-removed", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_appid_uri_changes.yml" + ], + "tags": [ + "attack.persistence", + "attack.credential_access", + "attack.privilege_escalation", + "attack.t1552", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "1b45b0d1-773f-4f23-aedc-814b759563b1", + "value": "Application AppID Uri Configuration Changes" + }, + { + "description": "Detects guest users being invited to tenant by non-approved inviters", + "meta": { + "author": "MikeDuddington, '@dudders1'", + "creation_date": "2022/07/28", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-gb/azure/active-directory/fundamentals/security-operations-user-accounts#monitoring-external-user-sign-ins", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_ad_guest_users_invited_to_tenant_by_non_approved_inviters.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "4ad97bf5-a514-41a4-abd3-4f3455ad4865", + "value": "Guest Users Invited To Tenant By Non Approved Inviters" + }, + { + "description": "Detects when a PIM elevation is approved or denied. Outside of normal operations should be investigated.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'", + "creation_date": "2022/08/09", + "falsepositive": [ + "Actual admin using PIM." + ], + "filename": "azure_pim_activation_approve_deny.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-identity-management#azure-ad-roles-assignment", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_pim_activation_approve_deny.yml" + ], + "tags": [ + "attack.privilege_escalation", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "039a7469-0296-4450-84c0-f6966b16dc6d", + "value": "PIM Approvals And Deny Elevation" + }, + { + "description": "Detects when highly privileged delegated permissions are granted on behalf of all users", + "meta": { + "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", + "creation_date": "2022/07/28", + "falsepositive": [ + "When the permission is legitimately needed for the app" + ], + "filename": "azure_app_delegated_permissions_all_users.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#application-granted-highly-privileged-permissions", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_delegated_permissions_all_users.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1528" + ] + }, + "related": [ + { + "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "a6355fbe-f36f-45d8-8efc-ab42465cbc52", + "value": "Delegated Permissions Granted For All Users" + }, + { + "description": "Monitor and alert for changes to the device registration policy.", + "meta": { + "author": "Michael Epping, '@mepples21'", + "creation_date": "2022/06/28", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_ad_device_registration_policy_changes.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-devices#device-registrations-and-joins-outside-policy", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_ad_device_registration_policy_changes.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.privilege_escalation", + "attack.t1484" + ] + }, + "related": [ + { + "dest-uuid": "ebb42bbe-62d7-47d7-a55f-3b08b61d792d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "9494bff8-959f-4440-bbce-fb87a208d517", + "value": "Changes to Device Registration Policy" + }, + { + "description": "Detects when a new admin is created.", + "meta": { + "author": "Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H', Tim Shelton", + "creation_date": "2022/08/11", + "falsepositive": [ + "A legitimate new admin account being created" + ], + "filename": "azure_privileged_account_creation.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-privileged-accounts#changes-to-privileged-accounts", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_privileged_account_creation.yml" + ], + "tags": [ + "attack.persistence", + "attack.privilege_escalation", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "f7b5b004-dece-46e4-a4a5-f6fd0e1c6947", + "value": "Privileged Account Creation" + }, + { + "description": "Monitor and alert on group membership removal of groups that have CA policy modification access", + "meta": { + "author": "Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'", + "creation_date": "2022/08/04", + "falsepositive": [ + "User removed from the group is approved" + ], + "filename": "azure_group_user_removal_ca_modification.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-infrastructure#conditional-access", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_group_user_removal_ca_modification.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.persistence", + "attack.t1548", + "attack.t1556" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "665e2d43-70dc-4ccc-9d27-026c9dd7ed9c", + "value": "User Removed From Group With CA Policy Modification Access" + }, + { + "description": "Detects when end user consent is blocked due to risk-based consent.", + "meta": { + "author": "Bailey Bercik '@baileybercik', Mark Morowczynski '@markmorow'", + "creation_date": "2022/07/10", + "falsepositive": [ + "Unknown" + ], + "filename": "azure_app_end_user_consent_blocked.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/security-operations-applications#end-user-stopped-due-to-risk-based-consent", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/audit_logs/azure_app_end_user_consent_blocked.yml" + ], + "tags": [ + "attack.credential_access", + "attack.t1528" + ] + }, + "related": [ + { + "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "7091372f-623c-4293-bc37-20c32b3492be", + "value": "End User Consent Blocked" + }, + { + "description": "Identifies when a service principal is created in Azure.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/02", + "falsepositive": [ + "Service principal being created may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Service principal created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_service_principal_created.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_service_principal_created.yml" + ], + "tags": [ + "attack.defense_evasion" + ] + }, + "uuid": "0ddcff6d-d262-40b0-804b-80eb592de8e3", + "value": "Azure Service Principal Created" + }, + { + "description": "Identifies when a key vault is modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/16", + "falsepositive": [ + "Key Vault being modified or deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Key Vault modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_keyvault_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_keyvault_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.credential_access", + "attack.t1552", + "attack.t1552.001" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "459a2970-bb84-4e6a-a32e-ff0fbd99448d", + "value": "Azure Key Vault Modified or Deleted" + }, + { + "description": "Identifies when Rule Collections (Application, NAT, and Network) is being modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "Rule Collections (Application, NAT, and Network) being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Rule Collections (Application, NAT, and Network) modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_firewall_rule_collection_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_firewall_rule_collection_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.defense_evasion", + "attack.t1562.004" + ] + }, + "related": [ + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "025c9fe7-db72-49f9-af0d-31341dd7dd57", + "value": "Azure Firewall Rule Collection Modified or Deleted" + }, + { + "description": "Identifies when an admission controller is executed in Azure Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.\nAn adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/11/25", + "falsepositive": [ + "Azure Kubernetes Admissions Controller may be done by a system administrator.", + "If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_admission_controller.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1078", + "attack.credential_access", + "attack.t1552", + "attack.t1552.007" + ] + }, + "related": [ + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "f8ef3a62-3f44-40a4-abca-761ab235c436", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "a61a3c56-4ce2-4351-a079-88ae4cbd2b58", + "value": "Azure Kubernetes Admission Controller" + }, + { + "description": "Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.", + "meta": { + "author": "sawwinnnaung", + "creation_date": "2020/05/07", + "falsepositive": [ + "Valid change" + ], + "filename": "azure_rare_operations.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/RareOperations.yaml", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_rare_operations.yml" + ], + "tags": [ + "attack.t1003" + ] + }, + "related": [ + { + "dest-uuid": "0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "c1182e02-49a3-481c-b3de-0fadc4091488", + "value": "Rare Subscription-level Operations In Azure" + }, + { + "description": "Identifies when a application gateway is modified or deleted.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/08/16", + "falsepositive": [ + "Application gateway being modified or deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Application gateway modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_application_gateway_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_application_gateway_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "ad87d14e-7599-4633-ba81-aeb60cfe8cd6", + "value": "Azure Application Gateway Modified or Deleted" + }, + { + "description": "Identifies when a application security group is modified or deleted.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/08/16", + "falsepositive": [ + "Application security group being modified or deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Application security group modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_application_security_group_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_application_security_group_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "835747f1-9329-40b5-9cc3-97d465754ce6", + "value": "Azure Application Security Group Modified or Deleted" + }, + { + "description": "Identifies the deletion of Azure Kubernetes Pods.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/07/24", + "falsepositive": [ + "Pods may be deleted by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Pods deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_pods_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://github.com/elastic/detection-rules/blob/065bf48a9987cd8bd826c098a30ce36e6868ee46/rules/integrations/azure/impact_kubernetes_pod_deleted.toml", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_pods_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "b02f9591-12c3-4965-986a-88028629b2e1", + "value": "Azure Kubernetes Pods Deleted" + }, + { + "description": "Identifies when a device or device configuration in azure is modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/03", + "falsepositive": [ + "Device or device configuration being modified or deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Device or device configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_device_or_configuration_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#core-directory", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_device_or_configuration_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.t1485", + "attack.t1565.001" + ] + }, + "related": [ + { + "dest-uuid": "d45a3d09-b3cf-48f4-9f0f-f521ee5cb05c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "46530378-f9db-4af9-a9e5-889c177d3881", + "value": "Azure Device or Configuration Modified or Deleted" + }, + { + "description": "Identifies when a application is deleted in Azure.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/03", + "falsepositive": [ + "Application being deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Application deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_application_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_application_deleted.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.impact", + "attack.t1489" + ] + }, + "related": [ + { + "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "410d2a41-1e6d-452f-85e5-abdd8257a823", + "value": "Azure Application Deleted" + }, + { + "description": "Detects when a user has been elevated to manage all Azure Subscriptions.\nThis change should be investigated immediately if it isn't planned.\nThis setting could allow an attacker access to Azure subscriptions in your environment.\n", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/11/26", + "falsepositive": [ + "If this was approved by System Administrator." + ], + "filename": "azure_subscription_permissions_elevation_via_activitylogs.yml", + "level": "high", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftauthorization", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_subscription_permissions_elevation_via_activitylogs.yml" + ], + "tags": [ + "attack.initial_access", + "attack.t1078.004" + ] + }, + "related": [ + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "09438caa-07b1-4870-8405-1dbafe3dad95", + "value": "Azure Subscription Permission Elevation Via ActivityLogs" + }, + { + "description": "Identifies when a Firewall Rule Configuration is Modified or Deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "Firewall Rule Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Firewall Rule Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_network_firewall_rule_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_network_firewall_rule_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "2a7d64cf-81fa-4daf-ab1b-ab80b789c067", + "value": "Azure Firewall Rule Configuration Modified or Deleted" + }, + { + "description": "Detects when a Azure Kubernetes Cluster is created or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/07", + "falsepositive": [ + "Kubernetes cluster being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Kubernetes cluster created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_cluster_created_or_deleted.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://attack.mitre.org/matrices/enterprise/cloud/", + "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", + "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_cluster_created_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "9541f321-7cba-4b43-80fc-fbd1fb922808", + "value": "Azure Kubernetes Cluster Created or Deleted" + }, + { + "description": "Identifies when a network security configuration is modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "Network Security Configuration being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Network Security Configuration modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_network_security_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_network_security_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "d22b4df4-5a67-4859-a578-8c9a0b5af9df", + "value": "Azure Network Security Configuration Modified or Deleted" + }, + { + "description": "Number of VM creations or deployment activities occur in Azure via the azureactivity log.", + "meta": { + "author": "sawwinnnaung", + "creation_date": "2020/05/07", + "falsepositive": [ + "Valid change" + ], + "filename": "azure_creating_number_of_resources_detection.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Creating_Anomalous_Number_Of_Resources_detection.yaml", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1098" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "d2d901db-7a75-45a1-bc39-0cbf00812192", + "value": "Number Of Resource Creation Or Deployment Activities" + }, + { + "description": "Identifies when a virtual network device is being modified or deleted.\nThis can be a network interface, network virtual appliance, virtual hub, or virtual router.\n", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "Virtual Network Device being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Virtual Network Device modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_network_virtual_device_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_network_virtual_device_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "15ef3fac-f0f0-4dc4-ada0-660aa72980b3", + "value": "Azure Virtual Network Device Modified or Deleted" + }, + { + "description": "Identifies when a Firewall Policy is Modified or Deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/02", + "falsepositive": [ + "Firewall Policy being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Firewall Policy modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_network_firewall_policy_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_network_firewall_policy_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.defense_evasion", + "attack.t1562.007" + ] + }, + "related": [ + { + "dest-uuid": "77532a55-c283-4cd2-bc5d-2d0b65e9d88c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "83c17918-746e-4bd9-920b-8e098bf88c23", + "value": "Azure Network Firewall Policy Modified or Deleted" + }, + { + "description": "Identifies when a service principal was removed in Azure.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/03", + "falsepositive": [ + "Service principal being removed may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Service principal removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_service_principal_removed.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_service_principal_removed.yml" + ], + "tags": [ + "attack.defense_evasion" + ] + }, + "uuid": "448fd1ea-2116-4c62-9cde-a92d120e0f08", + "value": "Azure Service Principal Removed" + }, + { + "description": "Identifies when a new cloudshell is created inside of Azure portal.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/09/21", + "falsepositive": [ + "A new cloudshell may be created by a system administrator." + ], + "filename": "azure_new_cloudshell_created.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_new_cloudshell_created.yml" + ], + "tags": [ + "attack.execution", + "attack.t1059" + ] + }, + "related": [ + { + "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "72af37e2-ec32-47dc-992b-bc288a2708cb", + "value": "Azure New CloudShell Created" + }, + { + "description": "Identifies when a application credential is modified.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/02", + "falsepositive": [ + "Application credential added may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Application credential added from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_app_credential_modification.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://www.cloud-architekt.net/auditing-of-msi-and-service-principals/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_app_credential_modification.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "cdeef967-f9a1-4375-90ee-6978c5f23974", + "value": "Azure Application Credential Modified" + }, + { + "description": "This detection uses azureactivity logs (Administrative category) to identify the deletion of an Azure AD Hybrid health AD FS service instance in a tenant.\nA threat actor can create a new AD Health ADFS service and create a fake server to spoof AD FS signing logs.\nThe health AD FS service can then be deleted after it is not longer needed via HTTP requests to Azure.\n", + "meta": { + "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC", + "creation_date": "2021/08/26", + "falsepositive": [ + "Legitimate AAD Health AD FS service instances being deleted in a tenant" + ], + "filename": "azure_aadhybridhealth_adfs_service_delete.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://o365blog.com/post/hybridhealthagent/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_service_delete.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1578.003" + ] + }, + "related": [ + { + "dest-uuid": "70857657-bd0b-4695-ad3e-b13f92cac1b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "48739819-8230-4ee3-a8ea-e0289d1fb0ff", + "value": "Azure Active Directory Hybrid Health AD FS Service Delete" + }, + { + "description": "Identifies when a suppression rule is created in Azure. Adversary's could attempt this to evade detection.", + "meta": { + "author": "Austin Songer", + "creation_date": "2021/08/16", + "falsepositive": [ + "Suppression Rule being created may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Suppression Rule created from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_suppression_rule_created.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_suppression_rule_created.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "92cc3e5d-eb57-419d-8c16-5c63f325a401", + "value": "Azure Suppression Rule Created" + }, + { + "description": "This detection uses azureactivity logs (Administrative category) to identify the creation or update of a server instance in an Azure AD Hybrid health AD FS service.\nA threat actor can create a new AD Health ADFS service and create a fake server instance to spoof AD FS signing logs. There is no need to compromise an on-prem AD FS server.\nThis can be done programmatically via HTTP requests to Azure.\n", + "meta": { + "author": "Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC", + "creation_date": "2021/08/26", + "falsepositive": [ + "Legitimate AD FS servers added to an AAD Health AD FS service instance" + ], + "filename": "azure_aadhybridhealth_adfs_new_server.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://o365blog.com/post/hybridhealthagent/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_aadhybridhealth_adfs_new_server.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1578" + ] + }, + "related": [ + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "288a39fc-4914-4831-9ada-270e9dc12cb4", + "value": "Azure Active Directory Hybrid Health AD FS New Server" + }, + { + "description": "Identifies when a owner is was removed from a application or service principal in Azure.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/03", + "falsepositive": [ + "Owner being removed may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Owner removed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_owner_removed_from_application_or_service_principal.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#application-proxy", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_owner_removed_from_application_or_service_principal.yml" + ], + "tags": [ + "attack.defense_evasion" + ] + }, + "uuid": "636e30d5-3736-42ea-96b1-e6e2f8429fd6", + "value": "Azure Owner Removed From Application or Service Principal" + }, + { + "description": "Identifies IPs from which users grant access to other users on azure resources and alerts when a previously unseen source IP address is used.", + "meta": { + "author": "sawwinnnaung", + "creation_date": "2020/05/07", + "falsepositive": [ + "Valid change" + ], + "filename": "azure_granting_permission_detection.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://github.com/Azure/Azure-Sentinel/blob/e534407884b1ec5371efc9f76ead282176c9e8bb/Detections/AzureActivity/Granting_Permissions_To_Account_detection.yaml", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_granting_permission_detection.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1098.003" + ] + }, + "related": [ + { + "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "a622fcd2-4b5a-436a-b8a2-a4171161833c", + "value": "Granting Of Permissions To An Account" + }, + { + "description": "Identifies when a Kubernetes account access a sensitive objects such as configmaps or secrets.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/07", + "falsepositive": [ + "Sensitive objects may be accessed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. Sensitive objects accessed from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_secret_or_config_object_access.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://attack.mitre.org/matrices/enterprise/cloud/", + "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", + "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_secret_or_config_object_access.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "7ee0b4aa-d8d4-4088-b661-20efdf41a04c", + "value": "Azure Kubernetes Secret or Config Object Access" + }, + { + "description": "Identifies when ClusterRoles/Roles are being modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/07", + "falsepositive": [ + "ClusterRoles/Roles being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "ClusterRoles/Roles modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_role_access.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://attack.mitre.org/matrices/enterprise/cloud/", + "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", + "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_role_access.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "818fee0c-e0ec-4e45-824e-83e4817b0887", + "value": "Azure Kubernetes Sensitive Role Access" + }, + { + "description": "Identifies when a Keyvault Key is modified or deleted in Azure.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/16", + "falsepositive": [ + "Key being modified or deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Key modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_keyvault_key_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_keyvault_key_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.credential_access", + "attack.t1552", + "attack.t1552.001" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "80eeab92-0979-4152-942d-96749e11df40", + "value": "Azure Keyvault Key Modified or Deleted" + }, + { + "description": "Identifies when a VPN connection is modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "VPN Connection being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "VPN Connection modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_vpn_connection_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_vpn_connection_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "61171ffc-d79c-4ae5-8e10-9323dba19cd3", + "value": "Azure VPN Connection Modified or Deleted" + }, + { + "description": "Detects when a Container Registry is created or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/07", + "falsepositive": [ + "Container Registry being created or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Container Registry created or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_container_registry_created_or_deleted.yml", + "level": "low", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://attack.mitre.org/matrices/enterprise/cloud/", + "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", + "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_container_registry_created_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "93e0ef48-37c8-49ed-a02c-038aab23628e", + "value": "Azure Container Registry Created or Deleted" + }, + { + "description": "Detects when Events are deleted in Azure Kubernetes. An adversary may delete events in Azure Kubernetes in an attempt to evade detection.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/07/24", + "falsepositive": [ + "Event deletions may be done by a system or network administrator. Verify whether the username, hostname, and/or resource name should be making changes in your environment. Events deletions from unfamiliar users or hosts should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_events_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://github.com/elastic/detection-rules/blob/da3852b681cf1a33898b1535892eab1f3a76177a/rules/integrations/azure/defense_evasion_kubernetes_events_deleted.toml", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_events_deleted.yml" + ], + "tags": [ + "attack.defense_evasion", + "attack.t1562", + "attack.t1562.001" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "225d8b09-e714-479c-a0e4-55e6f29adf35", + "value": "Azure Kubernetes Events Deleted" + }, + { + "description": "User Added to an Administrator's Azure AD Role", + "meta": { + "author": "Raphaël CALVET, @MetallicHack", + "creation_date": "2021/10/04", + "falsepositive": [ + "PIM (Privileged Identity Management) generates this event each time 'eligible role' is enabled." + ], + "filename": "azure_ad_user_added_to_admin_role.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://m365internals.com/2021/07/13/what-ive-learned-from-doing-a-year-of-cloud-forensics-in-azure-ad/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_ad_user_added_to_admin_role.yml" + ], + "tags": [ + "attack.persistence", + "attack.privilege_escalation", + "attack.t1098.003", + "attack.t1078" + ] + }, + "related": [ + { + "dest-uuid": "2dbbdcd5-92cf-44c0-aea2-fe24783a6bc3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "b17a1a56-e99c-403c-8948-561df0cffe81", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "ebbeb024-5b1d-4e16-9c0c-917f86c708a7", + "value": "User Added to an Administrator's Azure AD Role" + }, + { + "description": "Identifies when a Azure Kubernetes CronJob runs in Azure Cloud. Kubernetes Job is a controller that creates one or more pods and ensures that a specified number of them successfully terminate.\nKubernetes Job can be used to run containers that perform finite tasks for batch jobs. Kubernetes CronJob is used to schedule Jobs.\nAn Adversary may use Kubernetes CronJob for scheduling execution of malicious code that would run as a container in the cluster.\n", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/11/22", + "falsepositive": [ + "Azure Kubernetes CronJob/Job may be done by a system administrator.", + "If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_cronjob.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://kubernetes.io/docs/concepts/workloads/controllers/cron-jobs/", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://kubernetes.io/docs/concepts/workloads/controllers/job/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_cronjob.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1053.003", + "attack.privilege_escalation", + "attack.execution" + ] + }, + "related": [ + { + "dest-uuid": "2acf44aa-542f-4366-b4eb-55ef5747759c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "1c71e254-6655-42c1-b2d6-5e4718d7fc0a", + "value": "Azure Kubernetes CronJob" + }, + { + "description": "Detects the creation or patching of potential malicious RoleBinding/ClusterRoleBinding.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/07", + "falsepositive": [ + "RoleBinding/ClusterRoleBinding being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "RoleBinding/ClusterRoleBinding modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_rolebinding_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://attack.mitre.org/matrices/enterprise/cloud/", + "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", + "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_rolebinding_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.credential_access" + ] + }, + "uuid": "25cb259b-bbdc-4b87-98b7-90d7c72f8743", + "value": "Azure Kubernetes RoleBinding/ClusterRoleBinding Modified and Deleted" + }, + { + "description": "Identifies when a firewall is created, modified, or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "Firewall being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Firewall modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_firewall_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_firewall_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.defense_evasion", + "attack.t1562.004" + ] + }, + "related": [ + { + "dest-uuid": "5372c5fe-f424-4def-bcd5-d3a8e770f07b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "512cf937-ea9b-4332-939c-4c2c94baadcd", + "value": "Azure Firewall Modified or Deleted" + }, + { + "description": "Identifies when DNS zone is modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "DNS zone modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "DNS zone modification from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_dns_zone_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_dns_zone_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.t1565.001" + ] + }, + "related": [ + { + "dest-uuid": "1cfcb312-b8d7-47a4-b560-4b16cc677292", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "af6925b0-8826-47f1-9324-337507a0babd", + "value": "Azure DNS Zone Modified or Deleted" + }, + { + "description": "Identifies when a Virtual Network is modified or deleted in Azure.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "Virtual Network being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Virtual Network modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_virtual_network_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_virtual_network_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "bcfcc962-0e4a-4fd9-84bb-a833e672df3f", + "value": "Azure Virtual Network Modified or Deleted" + }, + { + "description": "Identifies when a device in azure is no longer managed or compliant", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/09/03", + "falsepositive": [ + "Administrator may have forgotten to review the device." + ], + "filename": "azure_device_no_longer_managed_or_compliant.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/reference-audit-activities#core-directory", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_device_no_longer_managed_or_compliant.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "542b9912-c01f-4e3f-89a8-014c48cdca7d", + "value": "Azure Device No Longer Managed or Compliant" + }, + { + "description": "Detection for when multi factor authentication has been disabled, which might indicate a malicious activity to bypass authentication mechanisms.", + "meta": { + "author": "@ionsor", + "creation_date": "2022/02/08", + "falsepositive": [ + "Authorized modification by administrators" + ], + "filename": "azure_mfa_disabled.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_mfa_disabled.yml" + ], + "tags": [ + "attack.persistence", + "attack.t1556" + ] + }, + "related": [ + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "7ea78478-a4f9-42a6-9dcd-f861816122bf", + "value": "Disabled MFA to Bypass Authentication Mechanisms" + }, + { + "description": "Identifies when a Point-to-site VPN is Modified or Deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/08", + "falsepositive": [ + "Point-to-site VPN being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Point-to-site VPN modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_network_p2s_vpn_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_network_p2s_vpn_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact" + ] + }, + "uuid": "d9557b75-267b-4b43-922f-a775e2d1f792", + "value": "Azure Point-to-site VPN Modified or Deleted" + }, + { + "description": "Identifies when secrets are modified or deleted in Azure.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/16", + "falsepositive": [ + "Secrets being modified or deleted may be performed by a system administrator.", + "Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Secrets modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_keyvault_secrets_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_keyvault_secrets_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.credential_access", + "attack.t1552", + "attack.t1552.001" + ] + }, + "related": [ + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "b831353c-1971-477b-abb6-2828edc3bca1", + "value": "Azure Keyvault Secrets Modified or Deleted" + }, + { + "description": "Identifies when a Azure Kubernetes network policy is modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/07", + "falsepositive": [ + "Network Policy being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Network Policy being modified and deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_network_policy_change.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://attack.mitre.org/matrices/enterprise/cloud/", + "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", + "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_network_policy_change.yml" + ], + "tags": [ + "attack.impact", + "attack.credential_access" + ] + }, + "uuid": "08d6ac24-c927-4469-b3b7-2e422d6e3c43", + "value": "Azure Kubernetes Network Policy Change" + }, + { + "description": "Identifies when a service account is modified or deleted.", + "meta": { + "author": "Austin Songer @austinsonger", + "creation_date": "2021/08/07", + "falsepositive": [ + "Service account being modified or deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment.", + "Service account modified or deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule." + ], + "filename": "azure_kubernetes_service_account_modified_or_deleted.yml", + "level": "medium", + "logsource.category": "No established category", + "logsource.product": "azure", + "refs": [ + "https://attack.mitre.org/matrices/enterprise/cloud/", + "https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/", + "https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1", + "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes", + "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/", + "https://github.com/SigmaHQ/sigma/tree/master/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml" + ], + "tags": [ + "attack.impact", + "attack.t1531" + ] + }, + "related": [ + { + "dest-uuid": "b24e2a20-3b3d-4bf0-823b-1ed765398fb0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "related-to" + } + ], + "uuid": "12d027c3-b48c-4d9d-8bb6-a732200034b2", + "value": "Azure Kubernetes Service Account Modified or Deleted" + }, { "description": "Detects a core dump of a crashing Nginx worker process, which could be a signal of a serious problem or exploitation attempts.", "meta": { @@ -88047,8 +88282,8 @@ "logsource.category": "No established category", "logsource.product": "No established product", "refs": [ - "https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/", "https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps", + "https://www.x41-dsec.de/lab/advisories/x41-2021-002-nginx-resolver-copy/", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/product/nginx/web_nginx_core_dump.yml" ], "tags": [ @@ -88157,8 +88392,8 @@ "logsource.category": "webserver", "logsource.product": "No established product", "refs": [ - "https://bad-jubies.github.io/RCE-NOW-WHAT/", "https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/", + "https://bad-jubies.github.io/RCE-NOW-WHAT/", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_win_webshells_in_access_logs.yml" ], "tags": [ @@ -88227,9 +88462,9 @@ "logsource.category": "webserver", "logsource.product": "No established product", "refs": [ + "https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/", "https://www.acunetix.com/blog/articles/using-logs-to-investigate-a-web-application-attack/", "https://github.com/payloadbox/sql-injection-payload-list", - "https://www.acunetix.com/blog/articles/exploiting-sql-injection-example/", "https://book.hacktricks.xyz/pentesting-web/sql-injection/mysql-injection", "https://brightsec.com/blog/sql-injection-payloads/", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_sql_injection_in_access_logs.yml" @@ -88298,11 +88533,11 @@ "logsource.category": "webserver", "logsource.product": "No established product", "refs": [ + "https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/", + "https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/", + "https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md", "https://twitter.com/httpvoid0x2f/status/1532924261035384832", "https://medium.com/geekculture/text4shell-exploit-walkthrough-ebc02a01f035", - "https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/", - "https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md", - "https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_java_payload_in_access_logs.yml" ], "tags": [ @@ -88408,8 +88643,8 @@ "logsource.category": "webserver", "logsource.product": "No established product", "refs": [ - "https://github.com/wpscanteam/wpscan/blob/196fbab5b1ce3870a43515153d4f07878a89d410/lib/wpscan/browser.rb", "https://github.com/lanmaster53/recon-ng/blob/9e907dfe09fce2997f0301d746796408e01a60b7/recon/core/base.py#L92", + "https://github.com/wpscanteam/wpscan/blob/196fbab5b1ce3870a43515153d4f07878a89d410/lib/wpscan/browser.rb", "https://github.com/xmendez/wfuzz/blob/1b695ee9a87d66a7d7bf6cae70d60a33fae51541/docs/user/basicusage.rst", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_susp_useragents.yml" ], @@ -88478,8 +88713,8 @@ "logsource.product": "No established product", "refs": [ "https://github.com/lijiejie/IIS_shortname_Scanner", - "https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml", "https://www.exploit-db.com/exploits/19525", + "https://github.com/projectdiscovery/nuclei-templates/blob/9d2889356eebba661c8407038e430759dfd4ec31/fuzzing/iis-shortname.yaml", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/webserver_generic/web_iis_tilt_shortname_scan.yml" ], "tags": [ @@ -89007,9 +89242,9 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/", - "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/", "https://blog.malwarebytes.com/threat-analysis/2016/11/telecrypt-the-ransomware-abusing-telegram-api-defeated/", + "https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/", + "https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_telegram_api.yml" ], "tags": [ @@ -89100,14 +89335,14 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "https://perishablepress.com/blacklist/ua-2013.txt", - "http://www.botopedia.org/search?searchword=scan&searchphrase=all", "https://networkraptor.blogspot.com/2015/01/user-agent-strings.html", - "http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules", "https://pbs.twimg.com/media/FtYbfsDXoAQ1Y8M?format=jpg&name=large", + "https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q", + "http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules", + "https://perishablepress.com/blacklist/ua-2013.txt", "https://twitter.com/crep1x/status/1635034100213112833", "https://www.bluecoat.com/en-gb/security-blog/2015-05-05/know-your-agents", - "https://twitter.com/kladblokje_88/status/1614673320124743681?s=12&t=joEpeVa5d58aHYNGA_To7Q", + "http://www.botopedia.org/search?searchword=scan&searchphrase=all", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_ua_malware.yml" ], "tags": [ @@ -89140,9 +89375,9 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638", "https://blog.talosintelligence.com/ipfs-abuse/", "https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11", + "https://isc.sans.edu/diary/IPFS%20phishing%20and%20the%20need%20for%20correctly%20set%20HTTP%20security%20headers/29638", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_susp_ipfs_cred_harvest.yml" ], "tags": [ @@ -89286,8 +89521,8 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65", "https://github.com/xmrig/xmrig/blob/427b6516e0550200c17ca28675118f0fffcc323f/src/version.h", + "https://github.com/xmrig/xmrig/blob/da22b3e6c45825f3ac1f208255126cb8585cd4fc/src/base/kernel/Platform_win.cpp#L65", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_ua_cryptominer.yml" ], "tags": [ @@ -89571,8 +89806,8 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap", "https://promos.mcafee.com/en-US/PDF/MTMW_Report.pdf", + "https://www.symantec.com/connect/blogs/shady-tld-research-gdn-and-our-2016-wrap", "https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/", "https://www.spamhaus.org/statistics/tlds/", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_download_susp_tlds_blacklist.yml" @@ -89624,8 +89859,8 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100", "https://github.com/rsmudge/Malleable-C2-Profiles/blob/26323784672913923d20c5a638c6ca79459e8529/normal/amazon.profile", + "https://www.hybrid-analysis.com/sample/ee5eca8648e45e2fea9dac0d920ef1a1792d8690c41ee7f20343de1927cc88b9?environmentId=100", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_cobalt_amazon.yml" ], "tags": [ @@ -89833,8 +90068,8 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules", "https://github.com/fastly/waf_testbed/blob/8bfc406551f3045e418cbaad7596cff8da331dfc/templates/default/scanners-user-agents.data.erb", + "http://rules.emergingthreats.net/open/snort-2.9.0/rules/emerging-user_agents.rules", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_ua_hacktool.yml" ], "tags": [ @@ -90054,8 +90289,8 @@ "logsource.category": "proxy", "logsource.product": "No established product", "refs": [ - "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html", "https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462", + "https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/web/proxy_generic/proxy_webdav_search_ms.yml" ], "tags": [ @@ -90130,8 +90365,8 @@ "logsource.category": "file_event", "logsource.product": "macos", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md", "https://posts.specterops.io/leveraging-emond-on-macos-for-persistence-a040a2785124", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.014/T1546.014.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/file_event/file_event_macos_emond_launch_daemon.yml" ], "tags": [ @@ -90324,8 +90559,8 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ - "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md", + "https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/python/collection/osx/screenshot.py", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_screencapture.yml" ], "tags": [ @@ -90433,8 +90668,8 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ - "https://redcanary.com/blog/applescript/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.002/T1059.002.md", + "https://redcanary.com/blog/applescript/", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_applescript.yml" ], "tags": [ @@ -90533,9 +90768,9 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ - "https://ss64.com/osx/dsenableroot.html", "https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md", "https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml", + "https://ss64.com/osx/dsenableroot.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml" ], "tags": [ @@ -90669,9 +90904,9 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ + "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf", "https://github.com/MythicAgents/typhon/", "https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html", - "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_jamf_susp_child.yml" ], "tags": [ @@ -90863,8 +91098,8 @@ "logsource.product": "macos", "refs": [ "https://linux.die.net/man/1/truncate", - "https://linux.die.net/man/1/dd", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027.001/T1027.001.md", + "https://linux.die.net/man/1/dd", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_binary_padding.yml" ], "tags": [ @@ -91097,8 +91332,8 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ - "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08", "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset", + "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-f5deb07688e1a8dec9530bc3071967b2da5c16b482e671812b864c37beb28f08", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_xcsset_malware_infection.yml" ], "tags": [ @@ -91154,9 +91389,9 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ - "https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml", - "https://www.manpagez.com/man/8/firmwarepasswd/", "https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web", + "https://www.manpagez.com/man/8/firmwarepasswd/", + "https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml" ], "tags": [ @@ -91508,8 +91743,8 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ - "https://ss64.com/osx/dseditgroup.html", "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos", + "https://ss64.com/osx/dseditgroup.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml" ], "tags": [ @@ -91737,8 +91972,8 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ - "https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/", "https://malpedia.caad.fkie.fraunhofer.de/details/osx.xcsset", + "https://www.microsoft.com/security/blog/2022/02/02/the-evolution-of-a-mac-trojan-updateagents-progression/", "https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-c68a1fcbf7a3f80c87225d7fdc031f691e9f3b6a14a36754be00762bfe6eae97", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_wizardupdate_malware_infection.yml" ], @@ -91895,9 +92130,9 @@ "logsource.category": "process_creation", "logsource.product": "macos", "refs": [ + "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf", "https://github.com/MythicAgents/typhon/", "https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html", - "https://www.zoocoup.org/casper/jamf_cheatsheet.pdf", "https://github.com/SigmaHQ/sigma/tree/master/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml" ], "tags": [ @@ -91955,8 +92190,8 @@ "logsource.product": "qualys", "refs": [ "https://community.qualys.com/docs/DOC-6406-reporting-toolbox-focused-search-lists", - "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", + "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.cisecurity.org/controls/cis-controls-list/", "https://github.com/SigmaHQ/sigma/tree/master/rules/compliance/default_credentials_usage.yml" ], @@ -91976,8 +92211,8 @@ "logsource.category": "No established category", "logsource.product": "qualys", "refs": [ - "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", + "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.cisecurity.org/controls/cis-controls-list/", "https://github.com/SigmaHQ/sigma/tree/master/rules/compliance/host_without_firewall.yml" ], @@ -91999,8 +92234,8 @@ "logsource.category": "No established category", "logsource.product": "No established product", "refs": [ - "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf", + "https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.04162018.pdf", "https://www.cisecurity.org/controls/cis-controls-list/", "https://github.com/SigmaHQ/sigma/tree/master/rules/compliance/netflow_cleartext_protocols.yml" ], @@ -92206,8 +92441,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/", "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", + "https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_bpfdoor_file_accessed.yml" ], "tags": [ @@ -92437,8 +92672,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/", "https://linux.die.net/man/1/xclip", + "https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_clipboard_collection.yml" ], "tags": [ @@ -92504,9 +92739,9 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://man7.org/linux/man-pages/man8/kmod.8.html", "https://linux.die.net/man/8/insmod", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md", + "https://man7.org/linux/man-pages/man8/kmod.8.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_load_module_insmod.yml" ], "tags": [ @@ -92574,9 +92809,9 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ + "https://objective-see.org/blog/blog_0x68.html", "https://www.glitch-cat.com/p/green-lambert-and-attack", "https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat", - "https://objective-see.org/blog/blog_0x68.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_unix_shell_configuration_modification.yml" ], "tags": [ @@ -92609,9 +92844,9 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md", "https://linux.die.net/man/1/import", "https://imagemagick.org/", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_screencapture_import.yml" ], "tags": [ @@ -92644,8 +92879,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md", "https://firewalld.org/documentation/man-pages/firewall-cmd.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.004/T1562.004.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_disable_system_firewall.yml" ], "tags": [ @@ -92712,8 +92947,8 @@ "logsource.product": "linux", "refs": [ "https://mn3m.info/posts/suid-vs-capabilities/", - "https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/", "https://int0x33.medium.com/day-44-linux-capabilities-privilege-escalation-via-openssl-with-selinux-enabled-and-enforced-74d2bec02099", + "https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/", "https://man7.org/linux/man-pages/man8/getcap.8.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_capabilities_discovery.yml" ], @@ -92789,8 +93024,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://blog.aquasec.com/container-security-tnt-container-attack", "https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html", + "https://blog.aquasec.com/container-security-tnt-container-attack", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_modify_system_firewall.yml" ], "tags": [ @@ -92823,8 +93058,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://github.com/Neo23x0/auditd/blob/master/audit.rules", "Self Experience", + "https://github.com/Neo23x0/auditd/blob/master/audit.rules", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_auditing_config_change.yml" ], "tags": [ @@ -92857,8 +93092,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.006/T1574.006.md", "https://eqllib.readthedocs.io/en/latest/analytics/fd9b987a-1101-4ed3-bda6-a70300eaf57e.html", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.006/T1574.006.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_ld_so_preload_mod.yml" ], "tags": [ @@ -93223,8 +93458,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/", "https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor", + "https://www.sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_bpfdoor_port_redirect.yml" ], "tags": [ @@ -93466,8 +93701,8 @@ "logsource.product": "linux", "refs": [ "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md", - "https://man7.org/linux/man-pages/man1/passwd.1.html", "https://superuser.com/questions/150675/how-to-display-password-policy-information-for-a-user-ubuntu", + "https://man7.org/linux/man-pages/man1/passwd.1.html", "https://linux.die.net/man/1/chage", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_password_policy_discovery.yml" ], @@ -93569,9 +93804,9 @@ "logsource.product": "linux", "refs": [ "https://access.redhat.com/articles/4409591#audit-record-types-2", - "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing", - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md", "https://linux.die.net/man/8/pam_tty_audit", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md", + "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml" ], "tags": [ @@ -93679,8 +93914,8 @@ "logsource.product": "linux", "refs": [ "https://www.youtube.com/watch?v=VmvY5SQm5-Y&ab_channel=M45C07", - "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files", "https://access.redhat.com/articles/4409591#audit-record-types-2", + "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/security_guide/sec-understanding_audit_log_files", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/auditd/lnx_auditd_create_account.yml" ], "tags": [ @@ -93713,9 +93948,9 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ + "https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/", "https://book.hacktricks.xyz/shells/shells/linux", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan", - "https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/lnx_susp_dev_tcp.yml" ], "tags": [ @@ -94018,9 +94253,9 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://digital.nhs.uk/cyber-alerts/2018/cc-2825", - "https://linux.die.net/man/8/useradd", "https://github.com/redcanaryco/atomic-red-team/blob/25acadc0b43a07125a8a5b599b28bbc1a91ffb06/atomics/T1136.001/T1136.001.md#atomic-test-5---create-a-new-user-in-linux-with-root-uid-and-gid", + "https://linux.die.net/man/8/useradd", + "https://digital.nhs.uk/cyber-alerts/2018/cc-2825", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/lnx_privileged_user_creation.yml" ], "tags": [ @@ -94061,8 +94296,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/", "https://github.com/Immersive-Labs-Sec/nimbuspwn", + "https://www.microsoft.com/security/blog/2022/04/26/microsoft-finds-new-elevation-of-privilege-linux-vulnerability-nimbuspwn/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/lnx_nimbuspwn_privilege_escalation_exploit.yml" ], "tags": [ @@ -94185,10 +94420,10 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://artkond.com/2017/03/23/pivoting-guide/", "https://github.com/rapid7/metasploit-framework/blob/eb6535009f5fdafa954525687f09294918b5398d/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb", - "http://pastebin.com/FtygZ1cg", "https://web.archive.org/web/20170319121015/http://www.threatgeek.com/2017/03/widespread-exploitation-attempts-using-cve-2017-5638.html", + "https://artkond.com/2017/03/23/pivoting-guide/", + "http://pastebin.com/FtygZ1cg", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/lnx_shell_susp_commands.yml" ], "tags": [ @@ -94453,8 +94688,8 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ - "https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c", "https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml", + "https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml" ], "tags": [ @@ -94487,9 +94722,9 @@ "logsource.category": "No established category", "logsource.product": "linux", "refs": [ + "https://www.openwall.com/lists/oss-security/2019/10/14/1", "https://access.redhat.com/security/cve/cve-2019-14287", "https://twitter.com/matthieugarin/status/1183970598210412546", - "https://www.openwall.com/lists/oss-security/2019/10/14/1", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/builtin/sudo/lnx_sudo_cve_2019_14287_user.yml" ], "tags": [ @@ -94630,10 +94865,10 @@ "logsource.category": "file_event", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event/file_event_lnx_wget_download_file_in_tmp_dir.yml" ], "tags": [ @@ -94667,10 +94902,10 @@ "logsource.category": "file_event", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event/file_event_lnx_susp_shell_script_under_profile_directory.yml" ], "tags": [ @@ -94783,8 +95018,8 @@ "logsource.category": "file_event", "logsource.product": "linux", "refs": [ - "https://research.splunk.com/endpoint/linux_doas_conf_file_creation/", "https://www.makeuseof.com/how-to-install-and-use-doas/", + "https://research.splunk.com/endpoint/linux_doas_conf_file_creation/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/file_event/file_event_lnx_doas_conf_creation.yml" ], "tags": [ @@ -94817,8 +95052,8 @@ "logsource.category": "network_connection", "logsource.product": "linux", "refs": [ - "https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent", "https://twitter.com/hakluke/status/1587733971814977537/photo/1", + "https://ngrok.com/docs/secure-tunnels/tunnels/ssh-reverse-tunnel-agent", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/network_connection/net_connection_lnx_ngrok_tunnel.yml" ], "tags": [ @@ -94951,9 +95186,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ + "https://www.openwall.com/lists/oss-security/2019/10/14/1", "https://access.redhat.com/security/cve/cve-2019-14287", "https://twitter.com/matthieugarin/status/1183970598210412546", - "https://www.openwall.com/lists/oss-security/2019/10/14/1", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_sudo_cve_2019_14287.yml" ], "tags": [ @@ -95028,10 +95263,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_nohup_susp_execution.yml" ], "tags": [ @@ -95144,8 +95379,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://gtfobins.github.io/gtfobins/vim/", "https://gtfobins.github.io/gtfobins/vimdiff/", + "https://gtfobins.github.io/gtfobins/vim/", "https://gtfobins.github.io/gtfobins/rvim/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_gtfobin_vim.yml" ], @@ -95179,10 +95414,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_shell_script_exec_from_susp_location.yml" ], "tags": [ @@ -95280,10 +95515,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_grep_os_arch_discovery.yml" ], "tags": [ @@ -95383,8 +95618,8 @@ "logsource.product": "linux", "refs": [ "https://linuxhint.com/uninstall-debian-packages/", - "https://sysdig.com/blog/mitre-defense-evasion-falco", "https://www.tutorialspoint.com/how-to-install-a-software-on-linux-using-yum-command", + "https://sysdig.com/blog/mitre-defense-evasion-falco", "https://linuxhint.com/uninstall_yum_package/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_remove_package.yml" ], @@ -95493,8 +95728,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md", "https://www.intezer.com/blog/malware-analysis/new-backdoor-sysjoker/", + "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1222.002/T1222.002.md", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_chmod_directories.yml" ], "tags": [ @@ -95696,9 +95931,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ + "https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html", "https://twitter.com/d1r4c/status/1279042657508081664", "https://medium.com/@petehouston/upload-files-with-curl-93064dcccc76", - "https://www.trendmicro.com/en_us/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html", "https://curl.se/docs/manpage.html", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-19---curl-upload-file", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_curl_fileupload.yml" @@ -95799,10 +96034,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://linuxize.com/post/how-to-delete-group-in-linux/", - "https://linux.die.net/man/8/userdel", - "https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/", "https://www.cyberciti.biz/faq/linux-remove-user-command/", + "https://linuxize.com/post/how-to-delete-group-in-linux/", + "https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/", + "https://linux.die.net/man/8/userdel", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_userdel.yml" ], "tags": [ @@ -95901,8 +96136,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html", "https://www.cyberciti.biz/faq/how-force-kill-process-linux/", + "https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_kill_process.yml" ], "tags": [ @@ -96093,8 +96328,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html", "https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/", + "https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vm.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_kill.yml" @@ -96119,10 +96354,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_shell_child_process_from_parent_tmp_folder.yml" ], "tags": [ @@ -96337,8 +96572,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://github.com/sleventyeleven/linuxprivchecker/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md", + "https://github.com/sleventyeleven/linuxprivchecker/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_history_recon.yml" ], "tags": [ @@ -96371,10 +96606,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_crontab_enumeration.yml" ], "tags": [ @@ -96407,8 +96642,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/", "https://bpftrace.org/", + "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_bpftrace_unsafe_option_usage.yml" ], "tags": [ @@ -96584,10 +96819,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ + "https://www.cyberciti.biz/faq/linux-remove-user-command/", "https://linuxize.com/post/how-to-delete-group-in-linux/", "https://linux.die.net/man/8/groupdel", "https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/", - "https://www.cyberciti.biz/faq/linux-remove-user-command/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_groupdel.yml" ], "tags": [ @@ -96654,9 +96889,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://github.com/carlospolop/PEASS-ng", - "https://github.com/diego-treitos/linux-smart-enumeration", "https://github.com/SaiSathvik1/Linux-Privilege-Escalation-Notes", + "https://github.com/diego-treitos/linux-smart-enumeration", + "https://github.com/carlospolop/PEASS-ng", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml" ], "tags": [ @@ -96756,8 +96991,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_system.html", + "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_system_discovery.yml" ], "tags": [ @@ -96989,8 +97224,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html", "https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/", + "https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html", "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vm.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vm_discovery.yml" @@ -97066,9 +97301,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html", "https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html", "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_storage.html", + "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_storage_discovery.yml" ], "tags": [ @@ -97109,8 +97344,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_network.html", + "https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_network_discovery.yml" ], "tags": [ @@ -97370,11 +97605,11 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ + "https://www.revshells.com/", + "https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/", + "https://man7.org/linux/man-pages/man1/ncat.1.html", "https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet", "https://www.infosecademy.com/netcat-reverse-shells/", - "https://www.revshells.com/", - "https://man7.org/linux/man-pages/man1/ncat.1.html", - "https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml" ], "tags": [ @@ -97408,8 +97643,8 @@ "logsource.product": "linux", "refs": [ "https://gtfobins.github.io/gtfobins/nohup/", - "https://www.computerhope.com/unix/unohup.htm", "https://en.wikipedia.org/wiki/Nohup", + "https://www.computerhope.com/unix/unohup.htm", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_nohup.yml" ], "tags": [ @@ -97555,9 +97790,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html", "https://www.trendmicro.com/en_us/research/21/e/darkside-linux-vms-targeted.html", "https://developer.vmware.com/docs/11743/esxi-7-0-esxcli-command-reference/namespace/esxcli_vsan.html", + "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_esxcli_vsan_discovery.yml" ], "tags": [ @@ -97598,10 +97833,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "Internal Research", - "https://github.com/carlospolop/PEASS-ng", "https://github.com/pathtofile/bad-bpf", "https://github.com/Gui774ume/ebpfkit", + "Internal Research", + "https://github.com/carlospolop/PEASS-ng", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_hack_tools.yml" ], "tags": [ @@ -97692,9 +97927,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ + "https://bpftrace.org/", "https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html", "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/", - "https://bpftrace.org/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_bpf_kprob_tracing_enabled.yml" ], "tags": [ @@ -97751,9 +97986,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ + "https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/", "https://www.mitiga.io/blog/mitiga-security-advisory-abusing-the-ssm-agent-as-a-remote-access-trojan", "https://www.bleepingcomputer.com/news/security/amazons-aws-ssm-agent-can-be-used-as-post-exploitation-rat-malware/", - "https://www.helpnetsecurity.com/2023/08/02/aws-instances-attackers-access/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_ssm_agent_abuse.yml" ], "tags": [ @@ -97845,9 +98080,9 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ + "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/", "https://blogs.blackberry.com/", "https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144", - "https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml" ], "tags": [ @@ -97880,10 +98115,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_wget_download_suspicious_directory.yml" ], "tags": [ @@ -97950,8 +98185,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://github.com/sleventyeleven/linuxprivchecker/", "https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.003/T1552.003.md", + "https://github.com/sleventyeleven/linuxprivchecker/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_history_delete.yml" ], "tags": [ @@ -98120,8 +98355,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_malware_gobrat_grep_payload_discovery.yml" ], @@ -98155,10 +98390,10 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", "https://blogs.jpcert.or.jp/en/2023/05/gobrat.html", - "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/", + "https://www.virustotal.com/gui/file/60bcd645450e4c846238cf0e7226dc40c84c96eba99f6b2cffcd0ab4a391c8b3/detection", + "https://www.virustotal.com/gui/file/3e44c807a25a56f4068b5b8186eee5002eed6f26d665a8b791c472ad154585d1/detection", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_susp_execution_tmp_folder.yml" ], "tags": [ @@ -98224,8 +98459,8 @@ "logsource.category": "process_creation", "logsource.product": "linux", "refs": [ - "https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/", "https://www.configserverfirewall.com/ubuntu-linux/ubuntu-add-user-to-root-group/", + "https://pberba.github.io/security/2021/11/23/linux-threat-hunting-for-persistence-account-creation-manipulation/", "https://github.com/SigmaHQ/sigma/tree/master/rules/linux/process_creation/proc_creation_lnx_usermod_susp_group.yml" ], "tags": [ @@ -98303,5 +98538,5 @@ "value": "Security Software Discovery - Linux" } ], - "version": 20231010 + "version": 20231017 } From a4ae58afcbcf88509da6cda5273406a2520470fc Mon Sep 17 00:00:00 2001 From: Christophe Vandeplas Date: Tue, 17 Oct 2023 11:29:52 +0200 Subject: [PATCH 05/20] chg: [threat-actor] increased version number --- clusters/threat-actor.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index d700bec..e271473 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -12002,5 +12002,5 @@ "value": "Void Rabisu" } ], - "version": 285 + "version": 286 } From 4b7f5c1e846873ada634bf167df3a2c12e1c5022 Mon Sep 17 00:00:00 2001 From: Sebastian Himmler Date: Thu, 19 Oct 2023 11:13:53 +0200 Subject: [PATCH 06/20] update malpedia galaxy --- clusters/malpedia.json | 605 ++++++++++++++++++++++++++++++++++++----- 1 file changed, 538 insertions(+), 67 deletions(-) diff --git a/clusters/malpedia.json b/clusters/malpedia.json index b1d9303..d6d9cd4 100644 --- a/clusters/malpedia.json +++ b/clusters/malpedia.json @@ -13,7 +13,7 @@ "name": "Malpedia", "source": "Malpedia", "type": "malpedia", - "uuid": "1d1c9af9-37fa-4deb-a928-f9b0abc7354a", + "uuid": "5fc98d08-90a4-498a-ad2e-0edf50ef374e", "values": [ { "description": "", @@ -156,6 +156,7 @@ "https://www.secrss.com/articles/24995", "https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w", "https://securelist.com/transparent-tribe-part-2/98233/", + "https://deform.co/hacker-group-caracal-kitten-targets-kdp-activists-with-malware/", "https://www.welivesecurity.com/2019/08/22/first-spyware-android-ahmyth-google-play/", "https://www.stratosphereips.org/blog/2020/11/10/android-mischief-rats-dataset" ], @@ -997,13 +998,16 @@ "value": "Dracarys" }, { - "description": "", + "description": "Android variant of ios.LightSpy.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.dragonegg", - "https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41" + "https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41", + "https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack" + ], + "synonyms": [ + "LightSpy" ], - "synonyms": [], "type": [] }, "uuid": "4ef28f14-17f4-4f87-a292-e63b42027c8c", @@ -1085,6 +1089,7 @@ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.ermac", "https://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html", "https://twitter.com/ESETresearch/status/1445618031464357888", + "https://twitter.com/ShilpeshTrivedi/status/1709096404835356883", "https://www.threatfabric.com/blogs/zombinder-ermac-and-desktop-stealers.html", "https://intel471.com/blog/rmac-2-0-perfecting-the-art-of-account-takeover", "https://blog.cyble.com/2022/05/25/ermac-back-in-action/", @@ -1325,6 +1330,7 @@ "https://twitter.com/alberto__segura/status/1402615237296148483", "https://www.cert.govt.nz/individuals/news-and-events/parcel-delivery-text-message-infecting-android-phones/", "https://securityblog.switch.ch/2021/06/19/android-flubot-enters-switzerland/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", "https://twitter.com/alberto__segura/status/1404098461440659459", "https://thehackernews.com/2022/01/widespread-flubot-and-teabot-malware.html", @@ -1545,6 +1551,7 @@ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.godfather", "https://brandefense.io/blog/godfather-android-banking-trojan/", "https://muha2xmad.github.io/malware-analysis/godfather/", + "https://github.com/LaurieWired/StrangeLoop", "https://blog.group-ib.com/godfather-trojan" ], "synonyms": [], @@ -1579,6 +1586,19 @@ "uuid": "e111fff8-c73c-4069-b804-2d3732653481", "value": "GoldenRAT" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/apk.gold_digger", + "https://www.group-ib.com/blog/golddigger-fraud-matrix/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "8ff9cde1-627e-4967-8b12-195544f31d83", + "value": "GoldDigger" + }, { "description": "", "meta": { @@ -2147,6 +2167,19 @@ "uuid": "41a9408d-7020-4988-af2c-51baf4d20763", "value": "MoqHao" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/apk.morder_rat", + "https://www.ctfiot.com/138538.html" + ], + "synonyms": [], + "type": [] + }, + "uuid": "f91f27ad-edcd-4e3d-824e-23f6acd81a7b", + "value": "MOrder RAT" + }, { "description": "", "meta": { @@ -3196,9 +3229,12 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/apk.wyrmspy", - "https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41" + "https://www.lookout.com/threat-intelligence/article/wyrmspy-dragonegg-surveillanceware-apt41", + "https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack" + ], + "synonyms": [ + "AndroidControl" ], - "synonyms": [], "type": [] }, "uuid": "77f81373-bb3a-449d-82ff-b28fe31acef6", @@ -5216,6 +5252,19 @@ "uuid": "263aaef5-9758-49f1-aff1-9a509f545bb3", "value": "HyperSSL (ELF)" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/elf.icefire", + "https://www.sentinelone.com/labs/icefire-ransomware-returns-now-targeting-linux-enterprise-networks/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "c03b2f7f-31ed-4133-b947-4b8846d90f19", + "value": "iceFire" + }, { "description": "", "meta": { @@ -5267,6 +5316,19 @@ "uuid": "a24f9c4b-1fa7-4da2-9929-064345389e67", "value": "IPStorm (ELF)" }, + { + "description": "ccording to Fortinet, this is a Mirai-based DDoS botnet.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/elf.iz1h9", + "https://www.fortinet.com/blog/threat-research/Iz1h9-campaign-enhances-arsenal-with-scores-of-exploits" + ], + "synonyms": [], + "type": [] + }, + "uuid": "6e98a149-9ce2-4750-9680-69f3ced5f33e", + "value": "IZ1H9" + }, { "description": "", "meta": { @@ -5524,6 +5586,7 @@ "https://blog.compass-security.com/2022/03/vpn-appliance-forensics/", "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/", "https://www.dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/", + "https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79", "https://analyst1.com/ransomware-diaries-volume-1/", "https://lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf", "https://www.ic3.gov/Media/News/2022/220204.pdf", @@ -6171,6 +6234,20 @@ "uuid": "de3c14aa-f9f4-4071-8e6e-a2c16a3394ad", "value": "PLEAD (ELF)" }, + { + "description": "Part of Mythic C2, written in Golang.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/elf.poseidon", + "https://github.com/MythicAgents/poseidon", + "https://cert.gov.ua/article/6123309" + ], + "synonyms": [], + "type": [] + }, + "uuid": "ad796632-2595-4ae5-a563-b92197210d61", + "value": "Poseidon (ELF)" + }, { "description": "", "meta": { @@ -6702,7 +6779,7 @@ "value": "SBIDIOT" }, { - "description": "", + "description": "According to CISA, this malware is a persistent backdoor that masquerades as a legitimate Barracuda Networks service. The malware is designed to listen to commands received from the Threat Actor’s Command-and-Control through TCP packets. When executed, the malware uses libpcap sniffer to monitor traffic for a magic packet on TCP port 25 (SMTP) and TCP port 587. It checks the network packet captured for a hard-coded string. When the right sequence of packet is captured, it establishes a TCP reverse shell to the C2 server for further exploitation. This allows the TA to execute arbitrary commands on the compromised system.\r\nThe malware is based on an open-source backdoor program named \"cd00r\".", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/elf.seaspy", @@ -7677,7 +7754,8 @@ "https://malpedia.caad.fkie.fraunhofer.de/details/ios.lightspy", "https://documents.trendmicro.com/assets/Tech-Brief-Operation-Poisoned-News-Hong-Kong-Users-Targeted-with-Mobile-Malware-via-Local-News-Links.pdf", "https://blog.trendmicro.com/trendlabs-security-intelligence/operation-poisoned-news-hong-kong-users-targeted-with-mobile-malware-via-local-news-links/", - "https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/" + "https://securelist.com/ios-exploit-chain-deploys-lightspy-malware/96407/", + "https://www.threatfabric.com/blogs/lightspy-mapt-mobile-payment-system-attack" ], "synonyms": [], "type": [] @@ -8206,6 +8284,19 @@ "uuid": "ec055670-4d25-4918-90c7-281fddf3a771", "value": "ChromeBack" }, + { + "description": "ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver further malware using the drive-by download technique. The malware leverages social engineering to trick the user into running a fake web browser update.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/js.clearfake", + "https://blog.sekoia.io/clearfake-a-newcomer-to-the-fake-updates-threats-landscape/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "8899bc6f-62e1-4732-988a-d5d64a5cf9bd", + "value": "ClearFake" + }, { "description": "WebAssembly-based crpyto miner.", "meta": { @@ -9732,10 +9823,11 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/osx.lockbit", + "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/", + "https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/", "https://twitter.com/malwrhunterteam/status/1647384505550876675", "https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf", - "https://blog.talosintelligence.com/talos-ir-q2-2023-quarterly-recap/", - "https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/" + "https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79" ], "synonyms": [], "type": [] @@ -10007,6 +10099,19 @@ "uuid": "bfd9e30e-ddc7-426f-8f77-4d2e1a846541", "value": "POOLRAT" }, + { + "description": "Part of Mythic C2, written in Golang.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/osx.poseidon", + "https://github.com/MythicAgents/poseidon" + ], + "synonyms": [], + "type": [] + }, + "uuid": "e4ac9105-c3ad-41e2-846b-048e2bbedc6a", + "value": "Poseidon (OS X)" + }, { "description": "", "meta": { @@ -11355,6 +11460,7 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/ps1.vipersoftx", "https://chris.partridge.tech/2022/evolution-of-vipersoftx-dga", + "https://www.trendmicro.com/en_us/research/23/d/vipersoftx-updates-encryption-steals-data.html", "https://decoded.avast.io/janrubin/vipersoftx-hiding-in-system-logs-and-spreading-venomsoftx/" ], "synonyms": [], @@ -12356,8 +12462,9 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.4h_rat", - "https://github.com/securitykitten/malware_references/blob/master/crowdstrike-intelligence-report-putter-panda.original.pdf", + "https://cocomelonc.github.io/malware/2023/09/25/malware-trick-36.html", "https://attack.mitre.org/groups/G0024", + "https://github.com/securitykitten/malware_references/blob/master/crowdstrike-intelligence-report-putter-panda.original.pdf", "https://cocomelonc.github.io/tutorial/2021/09/04/simple-malware-av-evasion.html" ], "synonyms": [], @@ -12858,6 +12965,7 @@ "https://blog.qualys.com/vulnerabilities-threat-research/2022/02/02/catching-the-rat-called-agent-tesla", "https://guillaumeorlando.github.io/AgentTesla", "https://malwatch.github.io/posts/agent-tesla-malware-analysis/", + "https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack", "https://inquest.net/blog/2021/11/02/adults-only-malware-lures", "http://www.secureworks.com/research/threat-profiles/gold-galleon", "https://researchcenter.paloaltonetworks.com/2017/09/unit42-analyzing-various-layers-agentteslas-packing/", @@ -12882,6 +12990,7 @@ "https://twitter.com/MsftSecIntel/status/1392219299696152578", "https://www.hornetsecurity.com/en/threat-research/vba-purging-malspam-campaigns/", "https://www.ciphertechsolutions.com/roboski-global-recovery-automation/", + "https://www.intrinsec.com/wp-content/uploads/2023/09/TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf", "https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord?", "https://www.splunk.com/en_us/blog/security/inside-the-mind-of-a-rat-agent-tesla-detection-and-analysis.html", "https://forensicitguy.github.io/agenttesla-rtf-dotnet-tradecraft/", @@ -13321,6 +13430,7 @@ "https://nao-sec.org/2019/04/Analyzing-amadey.html", "https://embee-research.ghost.io/amadey-bot-infrastructure/", "https://embee-research.ghost.io/redline-stealer-basic-static-analysis-and-c2-extraction/", + "https://www.zscaler.com/blogs/security-research/latest-version-amadey-introduces-screen-capturing-and-pushes-remcos-rat", "https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord", "https://thecyberexpress.com/amadey-botnet-back-via-phishing-sites/", "https://asec.ahnlab.com/en/41450/", @@ -13428,7 +13538,10 @@ "https://securityintelligence.com/posts/new-malware-trickbot-anchordns-backdoor-upgrades-anchormail/", "https://blog.google/threat-analysis-group/initial-access-broker-repurposing-techniques-in-targeted-attacks-against-ukraine/" ], - "synonyms": [], + "synonyms": [ + "ANCHOR.MAIL", + "Delegatz" + ], "type": [] }, "uuid": "7792096a-7623-43a1-9a67-28dce0e4b39e", @@ -13458,7 +13571,9 @@ "https://asec.ahnlab.com/ko/56256/", "https://asec.ahnlab.com/ko/47751/" ], - "synonyms": [], + "synonyms": [ + "ROCKHATCH" + ], "type": [] }, "uuid": "59a2437b-ae63-466a-9172-60d6610c3e19", @@ -13824,9 +13939,10 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.ariabody", "https://medium.com/insomniacs/aria-body-loader-is-that-you-53bdd630f8a1", - "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/", + "https://cocomelonc.github.io/malware/2023/09/25/malware-trick-36.html", "https://securelist.com/naikons-aria/96899/", - "https://securelist.com/it-threat-evolution-q2-2020/98230" + "https://securelist.com/it-threat-evolution-q2-2020/98230", + "https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/" ], "synonyms": [], "type": [] @@ -14063,7 +14179,7 @@ "value": "Astaroth" }, { - "description": "", + "description": "Astasia is a banking trojan that spreads through phishing emails that contain an executable attachment. Once the attachment is executed, Astasia downloads and installs a trojan that runs in the background. The trojan can steal personal information, such as passwords and credit card numbers, from victims.\r\n\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.astasia", @@ -14152,6 +14268,7 @@ "https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf", "https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html", "https://community.riskiq.com/article/ade260c6", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://aidenmitchell.ca/asyncrat-via-vbs/", "https://decoded.avast.io/threatintel/outbreak-of-follina-in-australia/", "https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4", @@ -14191,6 +14308,19 @@ "uuid": "c94c4f23-20d1-4858-8f94-01a54b213981", "value": "AsyncRAT" }, + { + "description": "Part of the Mythic framework, payload in C# (.NET 6), support HTTP, Websockets, Slack, SMB for C2.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.athena", + "https://cyble.com/blog/threat-actor-deploys-mythics-athena-agent-to-target-russian-semiconductor-suppliers/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "69bcd272-e69e-4548-bb8e-05eedcc3f13e", + "value": "Athena" + }, { "description": "", "meta": { @@ -14216,6 +14346,19 @@ "uuid": "e248d80d-de8e-45de-b6d0-3740e5b34573", "value": "ATI-Agent" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.atlas_agent", + "https://nsfocusglobal.com/warning-newly-discovered-apt-attacker-atlascross-exploits-red-cross-blood-drive-phishing-for-cyberattack/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "2fa8f479-63c3-4f91-954a-f30a50d2ad6e", + "value": "AtlasAgent" + }, { "description": "", "meta": { @@ -14523,6 +14666,7 @@ "https://muha2xmad.github.io/malware-analysis/warzonerat/", "https://blog.talosintelligence.com/2021/09/operation-armor-piercer.html", "https://mp.weixin.qq.com/s/C09P0al1nhsyyujHRp0FAw", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", "https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/", "https://www.fortinet.com/blog/threat-research/phishing-campaign-delivering-fileless-malware", @@ -15489,6 +15633,7 @@ "https://securityintelligence.com/posts/trickbot-gang-template-based-metaprogramming-bazar-malware/", "https://www.vkremez.com/2020/04/lets-learn-trickbot-bazarbackdoor.html", "https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/", + "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf", "https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/", "https://medium.com/walmartglobaltech/decrypting-bazarloader-strings-with-a-unicorn-15d2585272a9", "https://public.intel471.com/blog/trickbot-update-november-2020-bazar-loader-microsoft/", @@ -17312,6 +17457,7 @@ "https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/", "https://www.youtube.com/watch?v=a7W6rhkpVSM", "https://twitter.com/embee_research/status/1580030303950995456?s=20&t=0vfXnrCXaVSX-P-hiSrFwA", + "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://0xdarkvortex.dev/hiding-in-plainsight/", "https://andreafortuna.org/2023/02/23/how-to-detect-brute-ratel-activities", "https://bruteratel.com/research/feature-update/2021/06/01/PE-Reflection-Long-Live-The-King/", @@ -17327,7 +17473,8 @@ "https://medium.com/walmartglobaltech/brute-ratel-config-decoding-update-7820455022cb", "https://web.archive.org/web/20230216110153/https://yoroi.company/research/hunting-cyber-evil-ratels-from-the-targeted-attacks-to-the-widespread-usage-of-brute-ratel/", "https://twitter.com/MichalKoczwara/status/1652067563545800705", - "https://protectedmo.de/brute.html" + "https://protectedmo.de/brute.html", + "https://cybergeeks.tech/a-deep-dive-into-brute-ratel-c4-payloads-part-2/" ], "synonyms": [ "BruteRatel" @@ -17498,6 +17645,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee", + "https://twitter.com/Intrinsec/status/1709609529070010447", "https://www.bleepingcomputer.com/news/security/new-bumblebee-malware-replaces-contis-bazarloader-in-cyberattacks/", "https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads", "https://blog.cyble.com/2022/06/07/bumblebee-loader-on-the-rise/", @@ -17516,6 +17664,7 @@ "https://blog.cerbero.io/?p=2617", "https://www.botconf.eu/wp-content/uploads/formidable/2/2023_4889_DESOUZA.pdf", "https://0xtoxin.github.io/malware%20analysis/Bumblebee-DocuSign-Campaign/", + "https://twitter.com/Artilllerie/status/1701250284238823493", "https://sec-consult.com/blog/detail/bumblebee-hunting-with-a-velociraptor/", "https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks", "https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming", @@ -17548,6 +17697,7 @@ "https://www.deepinstinct.com/blog/the-dark-side-of-bumblebee-malware-loader", "https://isc.sans.edu/diary/28636", "https://research.openanalysis.net/bumblebee/malware/loader/unpacking/2022/05/12/bumblebee_loader.html", + "https://bin.re/blog/the-dga-of-bumblebee/", "https://thedfirreport.com/2022/08/08/bumblebee-roasts-its-way-to-domain-admin/", "https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/", "https://www.cynet.com/orion-threat-alert-flight-of-the-bumblebee/", @@ -17747,7 +17897,7 @@ "value": "CaddyWiper" }, { - "description": "", + "description": "CadelSpy is a spyware supposedly used by Iranian threat actors. It has several functions such as logging keystrokes, record audio, capture screenshots and webcam photos, and steal any documents that are sent to a printer.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.cadelspy", @@ -18226,6 +18376,19 @@ "uuid": "e4027aaa-de86-48ea-8567-c215cdb88ec1", "value": "Chaperone" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.chargeweapon", + "https://blog.eclecticiq.com/chinese-state-sponsored-cyber-espionage-activity-targeting-semiconductor-industry-in-east-asia" + ], + "synonyms": [], + "type": [] + }, + "uuid": "4eccbebb-9f7d-411f-a8fe-da01c99c8e3b", + "value": "ChargeWeapon" + }, { "description": "CHCH is a Ransomware spotted in the wild in December 2019. It encrypts victim files and adds the extension .chch to them while it drops a ransomware note named: READ_ME.TXT", "meta": { @@ -18799,9 +18962,12 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudburst", "https://www.mandiant.com/resources/blog/lightshow-north-korea-unc2970", - "https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/" + "https://www.microsoft.com/security/blog/2022/09/29/zinc-weaponizing-open-source-software/", + "https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/" + ], + "synonyms": [ + "NickelLoader" ], - "synonyms": [], "type": [] }, "uuid": "3f320960-77a2-4525-8d19-95b6028ec0d5", @@ -18864,6 +19030,7 @@ "https://www.proofpoint.com/us/threat-insight/post/coronavirus-threat-landscape-update", "https://threatresearch.ext.hp.com/javascript-malware-dispensing-rats-into-the-wild/", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf", + "https://www.intrinsec.com/wp-content/uploads/2023/09/TLP-CLEAR-20230912-EN-GuLoader-Information-report.pdf", "https://research.checkpoint.com/2020/guloader-cloudeye/", "https://www.proofpoint.com/us/blog/threat-insight/hakbit-ransomware-campaign-against-germany-austria-switzerland", "https://www.vmray.com/cyber-security-blog/guloader-evasion-techniques-threat-bulletin/", @@ -19000,6 +19167,7 @@ "https://www.trendmicro.com/en_us/research/21/k/Squirrelwaffle-Exploits-ProxyShell-and-ProxyLogon-to-Hijack-Email-Chains.html", "https://blog.talosintelligence.com/2020/09/CTIR-quarterly-trends-Q4-2020.html", "https://mp.weixin.qq.com/s/cGS8FocPnUdBconLbbaG-g", + "https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection", "https://news.sophos.com/en-us/2021/09/21/cring-ransomware-group-exploits-ancient-coldfusion-server/?cmp=30728", "https://unit42.paloaltonetworks.com/cobalt-strike-metadata-encryption-decryption/", "https://www.fortinet.com/blog/threat-research/the-year-of-the-wiper", @@ -19039,6 +19207,7 @@ "https://noticeofpleadings.com/crackedcobaltstrike/files/ComplaintAndSummons/1%20-Microsoft%20Cobalt%20Strike%20-%20Complaint(907040021.9).pdf", "https://www.trustnet.co.il/blog/virus-alert-to-powershell-encrypted-loader/", "https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks", "https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/", "https://www.getrevue.co/profile/80vul/issues/hunting-cobalt-strike-dns-redirectors-by-using-zoomeye-580734", "https://twitter.com/ffforward/status/1324281530026524672", @@ -19139,6 +19308,7 @@ "https://socfortress.medium.com/detecting-cobalt-strike-beacons-3f8c9fdcb654", "https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability/", "https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/hydrochasma-asia-medical-shipping-intelligence-gathering", "https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/", "https://www.cybereason.com/blog/threat-analysis-report-bumblebee-loader-the-high-road-to-enterprise-domain-control", "https://twitter.com/Unit42_Intel/status/1458113934024757256", @@ -19349,6 +19519,7 @@ "https://www.hhs.gov/sites/default/files/bazarloader.pdf", "https://blog.talosintelligence.com/2021/11/attackers-use-domain-fronting-technique.html", "https://go.recordedfuture.com/hubfs/reports/cta-2022-0503.pdf", + "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://decoded.avast.io/threatintel/decoding-cobalt-strike-understanding-payloads/", "https://asec.ahnlab.com/en/34549/", @@ -19388,6 +19559,7 @@ "https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/", "https://isc.sans.edu/diary/26752", "https://www.trendmicro.com/en_us/research/21/e/proxylogon-a-coinminer--a-ransomware--and-a-botnet-join-the-part.html", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/", "https://binary.ninja/2022/07/22/reverse-engineering-cobalt-strike.html", "https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-icedid-emotet-and-qbot", @@ -19604,6 +19776,7 @@ "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://www.istrosec.com/blog/apt-sk-cobalt/", "https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html", + "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://blog.talosintelligence.com/2020/12/quarterly-ir-report-fall-2020-q4.html", "https://www.wired.com/story/chinese-hackers-taiwan-semiconductor-industry-skeleton-key/", "https://www.youtube.com/watch?v=XfUTpwZKCDU", @@ -19941,7 +20114,7 @@ "value": "Combos" }, { - "description": "This malware was found in a backdoored Visual Studio project that was used to target security researchers.", + "description": "ComeBacker was found in a backdoored Visual Studio project that was used to target security researchers in Q4 2020 and early 2021.\r\n\r\nIt is an HTTP(S) downloader.\r\n\r\nIt uses the AES CBC cipher implemented through the OpenSSL's EVP interface for decryption of its configuration, and also for encryption and decryption of the client-server communication. \r\n\r\nThe parameter names in HTTP POST requests of the client are generated randomly. As the initial connection, the client exchanges the keys with the server via the Diffie–Hellman key agreement protocol for the elliptic curve secp521r1. The client generates a random 32-bytes long private key, and the server responds with its public key in a buffer starting with the wide character \"0\".\r\n\r\nNext, the clients sends the current local time, and the server responds with a buffer containing multiple values separated with the pipe symbol. The typical values are the encrypted payload, the export to execute, and the MD5 hash of the decrypted DLL to verify the authenticity of the payload. \r\n\r\nThere are variants of ComeBacker without statically linked OpenSSL. In that case, the key exchange is omitted and AES CBC is replaced with HC-256.\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.comebacker", @@ -20190,6 +20363,7 @@ "https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/?cmp=30728", "https://www.threatstop.com/blog/first-conti-then-hive-costa-rica-gets-hit-with-ransomware-again", "https://ke-la.com/zooming-into-darknet-threats-targeting-jp-orgs-kela/", + "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf", "https://medium.com/cycraft/the-road-to-ransomware-resilience-c1ca37036efd", "https://thehackernews.com/2022/05/malware-analysis-trickbot.html", "https://thedfirreport.com/2021/09/13/bazarloader-to-conti-ransomware-in-32-hours/", @@ -20238,8 +20412,9 @@ "https://0xthreatintel.medium.com/reversing-conti-ransomware-bfce15019e74", "https://www.trendmicro.com/en_us/research/22/c/cyberattacks-are-prominent-in-the-russia-ukraine-conflict.html", "https://arcticwolf.com/resources/blog/conti-ransomware-leak-analyzed", - "https://www.youtube.com/watch?v=cYx7sQRbjGA", + "https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79", "https://blogs.vmware.com/security/2022/09/threat-report-illuminating-volume-shadow-deletion.html", + "https://www.youtube.com/watch?v=cYx7sQRbjGA", "https://vulnerability.ch/2021/04/ransomware-and-date-leak-site-publication-time-analysis/", "https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/conti-group-targets-esxi-hypervisors-with-its-linux-variant.html", "https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force_Final_Report.pdf", @@ -20683,6 +20858,7 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.crimson", "https://twitter.com/katechondic/status/1502206599166939137", + "https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack", "https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html", "https://mp.weixin.qq.com/s/xUM2x89GuB8uP6otN612Fg", "https://securelist.com/transparent-tribe-part-1/98127/", @@ -21325,6 +21501,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.customerloader", + "https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/", "https://blog.sekoia.io/customerloader-a-new-malware-distributing-a-wide-variety-of-payloads/#h-c2-servers" ], "synonyms": [], @@ -21458,12 +21635,14 @@ "https://blog.netlab.360.com/dacls-the-dual-platform-rat/", "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/", "https://securelist.com/mata-multi-platform-targeted-malware-framework/97746/", + "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/", "https://malwareandstuff.com/peb-where-magic-is-stored/", "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", "https://blogs.vmware.com/security/2022/11/threat-analysis-active-c2-discovery-using-protocol-emulation-part4-dacls-aka-mata.html", "https://www.sygnia.co/mata-framework", "https://securelist.com/apt-trends-report-q2-2020/97937/", - "https://vblocalhost.com/uploads/VB2021-Park.pdf" + "https://vblocalhost.com/uploads/VB2021-Park.pdf", + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/18092216/Updated-MATA-attacks-Eastern-Europe_full-report_ENG.pdf" ], "synonyms": [ "MATA" @@ -21697,15 +21876,18 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate", "https://github.com/telekom-security/malware_analysis/blob/main/darkgate/extractor.py", + "https://www.trendmicro.com/en_us/research/23/j/darkgate-opens-organizations-for-attack-via-skype-teams.html", "https://www.truesec.com/hub/blog/darkgate-loader-delivered-via-teams", "https://decoded.avast.io/janrubin/meh-2-2/", "https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign", + "https://embee-research.ghost.io/decoding-a-simple-visual-basic-vbs-script-darkgate-loader/", "https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/", "https://www.zerofox.com/blog/the-underground-economist-volume-3-issue-12/", "https://www.aon.com/cyber-solutions/aon_cyber_labs/darkgate-keylogger-analysis-masterofnone/", "https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/", "https://decoded.avast.io/janrubin/complex-obfuscation-meh/", "https://github.com/prodaft/malware-ioc/blob/master/PTI-66/DarkGate.md", + "https://embee-research.ghost.io/practical-signatures-for-identifying-malware-with-yara/", "https://medium.com/@DCSO_CyTec/shortandmalicious-darkgate-d9102a457232", "https://github.security.telekom.com/2023/08/darkgate-loader.html" ], @@ -22206,6 +22388,7 @@ "https://blogs.infoblox.com/cyber-threat-intelligence/cyber-campaign-briefs/malspam-campaign-delivers-dark-crystal-rat-dcrat/", "https://go.recordedfuture.com/hubfs/reports/cta-2022-0919.pdf", "https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", "https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html", "https://kienmanowar.wordpress.com/2023/04/08/quicknote-uncovering-suspected-malware-distributed-by-individuals-from-vietnam/", @@ -22798,6 +22981,22 @@ "uuid": "6fa944af-3def-437a-8a52-9234782b5bb8", "value": "Diavol" }, + { + "description": "A RAT written in .NET, used by FIN7 since 2021. In some instances dropped by ps1.powertrash.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.diceloader", + "https://www.mandiant.com/resources/blog/evolution-of-fin7", + "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319" + ], + "synonyms": [ + "Lizar" + ], + "type": [] + }, + "uuid": "f8e7673a-c8dc-406a-851e-48756074b5c6", + "value": "DICELOADER" + }, { "description": "APT10's fork of the (open-source) Quasar RAT.", "meta": { @@ -22838,6 +23037,19 @@ "uuid": "8f5ce8a6-c5fe-4c62-b25b-6ce0f3b724c5", "value": "Dimnie" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.dinodas_rat", + "https://www.welivesecurity.com/en/eset-research/operation-jacana-spying-guyana-entity/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "a8eaa325-3e89-41af-9de0-ae2c992148a5", + "value": "DinodasRAT" + }, { "description": "Downloader.", "meta": { @@ -23115,7 +23327,7 @@ "value": "DogHousePower" }, { - "description": "", + "description": "Since late February 2023, Minodo Backdoor campaigns have been employed to deliver either the Project Nemesis information stealer or more sophisticated backdoors like Cobalt Strike. This backdoor collects basic system information, which it then transmits to the C2 server. In return, it receives an AES-encrypted payload. Notably, the Minodo Backdoor is designed to contact a different C2 address for domain-joined systems. This suggests that more capable backdoors, such as Cobalt Strike, are downloaded on higher-value targets instead of Project Nemesis.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.domino", @@ -23876,6 +24088,7 @@ "https://docs.broadcom.com/doc/w32-duqu-11-en", "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet_research.pdf", "https://securelist.com/blog/research/70504/the-mystery-of-duqu-2-0-a-sophisticated-cyberespionage-actor-returns/", + "https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf", "https://cocomelonc.github.io/tutorial/2022/05/09/malware-pers-4.html", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf", "https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf" @@ -23986,6 +24199,19 @@ "uuid": "1ecbcd20-f238-47ef-874b-08ef93266395", "value": "Dyre" }, + { + "description": "According to Elastic, EagerBee loads additional capabilities using remotely-downloaded PE files, hosted in C2. However, its implementation and coding practices reveal a lack of advanced skills from the author, relying on basic techniques. During their research, they identified string formatting and underlying behavior that aligns with previous research attributed to a Chinese-speaking threat actor referred to as LuckyMouse (APT27, EmissaryPanda).", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.eagerbee", + "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set" + ], + "synonyms": [], + "type": [] + }, + "uuid": "20615110-ec2a-4ead-a7e4-cadecf1fa6bc", + "value": "EagerBee" + }, { "description": "This RAT written in C# was derived from HorusEyesRat. It was modified by \"Arsium\" and published on GitHub. There is also a client builder included.\r\nGithub Source: https://github.com/arsium/EagleMonitorRAT", "meta": { @@ -24462,6 +24688,7 @@ "https://www.atomicmatryoshka.com/post/malware-headliners-emotet", "https://www.hornetsecurity.com/en/security-information/emotet-update-increases-downloads/", "https://blog.nviso.eu/2022/03/23/hunting-emotet-campaigns-with-kusto/", + "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf", "https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", "https://pl-v.github.io/plv/posts/Emotet-unpacking/", @@ -24502,6 +24729,7 @@ "https://persianov.net/emotet-malware-analysis-part-2", "https://intezer.com/blog/research/how-hackers-use-binary-padding-to-outsmart-sandboxes/", "https://www.fortinet.com/blog/threat-research/bad-actors-capitalize-current-events-email-scams", + "https://infosecwriteups.com/unpacking-emotet-trojan-dac7e6119a0a", "https://www.securityartwork.es/2021/06/16/analisis-campana-emotet/", "https://www.zdnet.com/article/meet-the-white-hat-group-fighting-emotet-the-worlds-most-dangerous-malware/", "https://www.fortinet.com/blog/threat-research/deep-analysis-of-new-emotet-variant-part-2.html", @@ -24702,6 +24930,19 @@ "uuid": "8dc64857-abb1-4926-8114-052f9ba4bc33", "value": "Entropy" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.entryshell", + "https://www.virusbulletin.com/conference/vb2023/abstracts/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "73a0919b-1c81-4af5-a6d1-8fb5ae951269", + "value": "EntryShell" + }, { "description": "", "meta": { @@ -24723,6 +24964,7 @@ "https://mrtiepolo.medium.com/sophisticated-apt29-campaign-abuses-notion-api-to-target-the-european-commission-200188059f58", "https://blogs.blackberry.com/en/2023/03/nobelium-targets-eu-governments-assisting-ukraine", "https://go.recordedfuture.com/hubfs/reports/cta-2022-0503.pdf", + "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://blog.bushidotoken.net/2022/06/overview-of-russian-gru-and-svr.html", "https://unit42.paloaltonetworks.com/cloaked-ursa-online-storage-services-campaigns/", "https://www.sekoia.io/en/nobeliums-envyscout-infection-chain-goes-in-the-registry-targeting-embassies/", @@ -25372,6 +25614,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.fabookie", + "https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/", "https://medium.com/@lcam/updates-from-the-maas-new-threats-delivered-through-nullmixer-d45defc260d1", "https://ics-cert.kaspersky.com/publications/reports/2021/12/16/pseudomanuscrypt-a-mass-scale-spyware-attack-campaign/" ], @@ -25945,6 +26188,7 @@ "https://securelist.com/the-flame-questions-and-answers-51/34344/", "https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=ce2df4da-afe9-4a24-b28c-0fb3ba671d95&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments", "https://github.com/juanandresgs/papers/raw/master/Flame%202.0%20Risen%20from%20the%20Ashes.pdf", + "https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf", "https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf", "https://www.crysys.hu/publications/files/skywiper.pdf", "https://storage.googleapis.com/chronicle-research/Flame%202.0%20Risen%20from%20the%20Ashes.pdf", @@ -26730,7 +26974,8 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.gauss", "http://contagiodump.blogspot.com/2012/08/gauss-samples-nation-state-cyber.html", - "https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf" + "https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf", + "https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf" ], "synonyms": [], "type": [] @@ -27477,6 +27722,8 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.goldbackdoor", + "https://github.com/blackorbird/APT_REPORT/blob/master/group123/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf", + "https://www.0x0v1.com/rearchive-goldbackdoor/", "https://stairwell.com/wp-content/uploads/2022/04/Stairwell-threat-report-The-ink-stained-trail-of-GOLDBACKDOOR.pdf" ], "synonyms": [], @@ -27844,6 +28091,7 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.graftor", "http://blog.talosintelligence.com/2017/09/graftor-but-i-never-asked-for-this.html", + "https://malware.news/t/graftor-but-i-never-asked-for-this/14857", "https://bin.re/blog/the-dga-of-symmi/" ], "synonyms": [ @@ -27915,10 +28163,12 @@ "https://malpedia.caad.fkie.fraunhofer.de/details/win.graphdrop", "https://www.avertium.com/resources/threat-reports/evolution-of-russian-apt29-new-attacks-and-techniques-uncovered", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf", - "https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/" + "https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/", + "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing" ], "synonyms": [ - "GraphicalProton" + "GraphicalProton", + "SPICYBEAT" ], "type": [] }, @@ -28576,7 +28826,9 @@ "https://github.com/HavocFramework/Havoc", "https://4pfsec.com/havoc-c2-first-look/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks", "https://twitter.com/embee_research/status/1579668721777643520?s=20&t=nDJOv1Yf5mQZKCou7qMrhQ", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://www.youtube.com/watch?v=ErPKP4Ms28s", "https://www.zscaler.com/blogs/security-research/havoc-across-cyberspace", "https://checkmarx.com/blog/first-known-targeted-oss-supply-chain-attacks-against-the-banking-sector/" @@ -29100,7 +29352,8 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.hijackloader", - "https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader" + "https://www.zscaler.com/blogs/security-research/technical-analysis-hijackloader", + "https://alpine-sec.medium.com/hijackloader-targets-hotels-a-technical-analysis-c2795fc4f3a3" ], "synonyms": [], "type": [] @@ -29126,6 +29379,24 @@ "uuid": "35fd4bd7-d510-40fd-b89c-8a1b10dbc3f1", "value": "HiKit" }, + { + "description": "A new ransomware family was discovered in August 2019. Called HILDACRYPT, it is named after the Netflix cartoon “Hilda” because the TV show’s YouTube trailer was included in the ransom note of the original version of the malware.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.hildacrypt", + "https://www.acronis.com/en-eu/blog/posts/popular-backup-solutions-easily-disabled-recent-hildacrypt-ransomware/", + "https://youtu.be/Oqg20dF8tTA", + "https://securitynews.sonicwall.com/xmlpost/hildacrypt-ransomware-actively-spreading-in-the-wild/", + "https://www.bleepingcomputer.com/news/security/hildacrypt-ransomware-developer-releases-decryption-keys/", + "https://www.acronis.com/en-eu/blog/posts/hildacrypt-ransomware-newcomer-hits-backup-and-anti-virus-solutions/", + "https://blog.sonicwall.com/en-us/2019/11/mindhunter-meeting-a-russian-ransomware-cell/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "fb637fc1-c06b-4b68-b261-0e1c0bd1e17b", + "value": "HILDACRYPT" + }, { "description": "", "meta": { @@ -29798,8 +30069,9 @@ "https://therecord.media/meet-prometheus-the-secret-tds-behind-some-of-todays-malware-campaigns/", "https://elis531989.medium.com/funtastic-packers-and-where-to-find-them-41429a7ef9a7", "https://blog.talosintelligence.com/2020/07/valak-emerges.html", - "https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol", + "https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection", "https://blog.group-ib.com/prometheus-tds", + "https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol", "https://www.team-cymru.com/post/inside-the-icedid-backconnect-protocol-part-2", "https://medium.com/@dawid.golak/icedid-aka-bokbot-analysis-with-ghidra-560e3eccb766", "https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/", @@ -29818,8 +30090,8 @@ "https://thedfirreport.com/2022/04/25/quantum-ransomware/", "https://www.uptycs.com/blog/icedid-campaign-spotted-being-spiced-with-excel-4-macros", "https://download.microsoft.com/download/f/8/1/f816b8b6-bee3-41e5-b6cc-e925a5688f61/Microsoft_Digital_Defense_Report_2020_September.pdf", - "https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf", + "https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/", "https://www.bleepingcomputer.com/news/security/hackers-target-ukrainian-govt-with-icedid-malware-zimbra-exploits/", "https://www.esentire.com/blog/icedid-to-cobalt-strike-in-under-20-minutes", "https://forensicitguy.github.io/analyzing-icedid-document/", @@ -29834,6 +30106,7 @@ "https://blogs.vmware.com/security/2021/07/icedid-analysis-and-detection.html", "https://www.vkremez.com/2018/09/lets-learn-deeper-dive-into.html", "https://awakesecurity.com/blog/detecting-icedid-and-cobalt-strike-beacon-with-network-detection-and-response/", + "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf", "https://malwation.com/icedid-malware-technical-analysis-report/", "https://resource.redcanary.com/rs/003-YRU-314/images/2021-Threat-Detection-Report.pdf", "https://www.secureworks.com/research/threat-profiles/gold-swathmore", @@ -29875,6 +30148,7 @@ "https://go.recordedfuture.com/hubfs/reports/cta-2022-0118.pdf", "https://github.com/f0wl/deICEr", "https://securelist.com/malicious-spam-campaigns-delivering-banking-trojans/102917", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://isc.sans.edu/diary/Google+ads+lead+to+fake+software+pages+pushing+IcedID+Bokbot/29344", "https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware/", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", @@ -29963,6 +30237,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid_downloader", + "https://www.netresec.com/?page=Blog&month=2023-10&post=Forensic-Timeline-of-an-IcedID-Infection", "https://threatray.com/blog/a-new-icedid-gziploader-variant/", "http://www.intezer.com/icedid-banking-trojan-shares-code-pony-2-0-trojan/", "https://securityintelligence.com/new-banking-trojan-icedid-discovered-by-ibm-x-force-research/" @@ -30584,8 +30859,9 @@ "https://www.vmray.com/cyber-security-blog/analyzing-ursnif-behavior-malware-sandbox/", "https://www.cleafy.com/cleafy-labs/digital-banking-fraud-how-the-gozi-malware-work", "https://blog.yoroi.company/research/the-ursnif-gangs-keep-threatening-italy/", - "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader", + "https://twitter.com/JAMESWT_MHT/status/1712783250446328114?t=iLKXzsZuS1TTa0i9sZFkQA&s=19", "https://threatresearch.ext.hp.com/detecting-ta551-domains/", + "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-batloader", "https://intel471.com/blog/ettersilent-maldoc-builder-macro-trickbot-qbot/", "https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/", "https://www.tgsoft.it/files/report/download.asp?id=568531345", @@ -30593,6 +30869,7 @@ "https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf", "https://www.cybereason.com/blog/cybereason-vs-egregor-ransomware", "https://insight-jp.nttsecurity.com/post/102i7af/steelclovergoogle", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://www.justice.gov/opa/pr/officials-announce-international-operation-targeting-transnational-criminal-organization", "https://malware.love/malware_analysis/reverse_engineering/2020/11/27/analyzing-a-vbs-dropper.html", "https://redcanary.com/resources/webinars/deep-dive-process-injection/", @@ -31806,7 +32083,7 @@ "value": "Knot" }, { - "description": "Koadic is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub. Koadic has several options for staging payloads and creating implants, and performs most of its operations using Windows Script Host.", + "description": "Koadic is an open-source post-exploitation framework for Windows, created by zerosum0x0 and available on GitHub. The framework is written in Python and can generate JScript and VBScript payloads which can be written to disk or mapped directly into memory. Its capabilities include remote desktop access, command execution, lateral movement via SMB, file transfer, credential theft using Mimikatz, port scanning, and system information collection. It can also collect specific system information and targeted files based on their name or extension.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.koadic", @@ -32534,6 +32811,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.lgoogloader", + "https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/", "https://blog.polyswarm.io/nullmixer-drops-multiple-malware-families" ], "synonyms": [], @@ -32888,6 +33166,7 @@ "https://www.bleepingcomputer.com/news/security/lockbit-ransomware-recruiting-insiders-to-breach-corporate-networks/", "https://github.com/EmissarySpider/ransomware-descendants", "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-1-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254354", + "https://medium.com/@lcam/lighting-the-exfiltration-infrastructure-of-a-lockbit-affiliate-and-more-f57fbb7a4e79", "https://github.com/albertzsigovits/malware-notes/blob/master/Ransomware/Lockbit.md", "https://www.crypsisgroup.com/insights/ransomwares-new-trend-exfiltration-and-extortion", "https://techcommunity.microsoft.com/t5/security-compliance-and-identity/part-2-lockbit-2-0-ransomware-bugs-and-database-recovery/ba-p/3254421", @@ -33503,7 +33782,8 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.lu0bot", - "https://bazaar.abuse.ch/browse/tag/Lu0Bot/" + "https://bazaar.abuse.ch/browse/tag/Lu0Bot/", + "https://embee-research.ghost.io/practical-signatures-for-identifying-malware-with-yara/" ], "synonyms": [], "type": [] @@ -33511,6 +33791,22 @@ "uuid": "d81c068d-7420-40ee-ab50-5f29b2ccc314", "value": "Lu0Bot" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.luadream", + "https://r136a1.dev/2023/09/22/more-on-dreamland/", + "https://www.sentinelone.com/labs/sandman-apt-a-mystery-group-targeting-telcos-with-a-luajit-toolkit/" + ], + "synonyms": [ + "DreamLand" + ], + "type": [] + }, + "uuid": "a6fee19a-21e4-4e2c-9c1f-a38d0732f661", + "value": "LuaDream" + }, { "description": "According to PCRisk, The Luca stealer can extract a variety of information from compromised machines. It targets data related to the following: operating system, device name, CPUs, desktop environment, network interface, user account name, preferred system language, running processes, etc.\r\n\r\nThis malicious program can steal information from over thirty Chromium-based browsers. From these applications, Luca can obtain Internet cookies, account log-in credentials (usernames/passwords), and credit card numbers. Additionally, the stealer can extract data from password manager and cryptowallet browser extensions compatible with over twenty browsers.\r\n\r\nThis malware also targets various messaging applications like Telegram, Discord, ICQ, Skype, Element, etc. It likewise aims to acquire information from gaming-related software such as Steam and Uplay (Ubisoft Connect). Furthermore, some versions of Luca can take screenshots and download the files stored on victims' devices.", "meta": { @@ -33561,7 +33857,7 @@ "value": "Luminosity RAT" }, { - "description": "Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor \"Shamel\", who goes by the alias \"Lumma\". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the URI \"/c2sock\" and the user agent \"TeslaBrowser/5.5\".\"", + "description": "Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor \"Shamel\", who goes by the alias \"Lumma\". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent \"TeslaBrowser/5.5\".\" The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma", @@ -33573,6 +33869,7 @@ "https://medium.com/s2wblog/lumma-stealer-targets-youtubers-via-spear-phishing-email-ade740d486f7", "https://darktrace.com/blog/the-rise-of-the-lumma-info-stealer", "https://www.rapid7.com/blog/post/2023/08/31/fake-update-utilizes-new-idat-loader-to-execute-stealc-and-lumma-infostealers/", + "https://www.intrinsec.com/lumma_stealer_actively_deployed_in_multiple_campaigns/", "https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/", "https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx" ], @@ -33789,7 +34086,7 @@ "value": "Maggie" }, { - "description": "", + "description": "According to Talos, MagicRAT is programmed in C++ programming language and uses the Qt Framework by statically linking it to the RAT on 32- and 64-bit versions. The Qt Framework is a programming library for developing graphical user interfaces, of which this RAT has none. Talos thinks that the objective was to increase the complexity of the code, thus making human analysis harder. On the other hand, since there are very few examples (if any) of malware programmed with Qt Framework, this also makes machine learning and heuristic analysis detection less reliable. The RAT uses the Qt classes throughout its entire code. The configuration is dynamically stored in a QSettings class eventually being saved to disk, a typical functionality provided by that class.\r\n\r\nMagicRAT provides the operator with a remote shell on the victim's system for arbitrary command execution, along with the ability to rename, move and delete files on the endpoint. The operator can determine the timing for the implant to sleep, change the C2 URLs and delete the implant from the infected system.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.magic_rat", @@ -34055,6 +34352,19 @@ "uuid": "54cd671e-b7e4-4dd3-9bfa-dc0ba5105944", "value": "ManameCrypt" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.mango", + "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "e3be5820-5cf9-4455-9b46-c88e7fbebd85", + "value": "Mango" + }, { "description": "", "meta": { @@ -34189,6 +34499,19 @@ "uuid": "c19ac191-a881-437f-ae82-7bec174590cb", "value": "MarkiRAT" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.marracrypt", + "https://securitynews.sonicwall.com/xmlpost/marracrypt-ransomware-actively-spreading-in-the-wild/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "bbe77240-d8e5-41b5-88ac-e9a91aa54a13", + "value": "MarraCrypt" + }, { "description": "Ransomware written in Delphi.", "meta": { @@ -34824,9 +35147,10 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.merlin", - "https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f", "http://lockboxx.blogspot.com/2018/02/intro-to-using-gscript-for-red-teams.html", "https://github.com/Ne0nd0g/merlin", + "https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f", + "https://www.securonix.com/blog/threat-labs-security-advisory-new-starkvortex-attack-campaign-threat-actors-use-drone-manual-lures-to-deliver-merlinagent-payloads/", "http://lockboxx.blogspot.com/2018/02/merlin-for-red-teams.html" ], "synonyms": [], @@ -35333,6 +35657,7 @@ "https://labs.f-secure.com/blog/catching-lazarus-threat-intelligence-to-real-detection-logic-part-two", "https://www.cisa.gov/uscert/sites/default/files/publications/AA22-152A_Karakurt_Data_Extortion_Group.pdf", "https://securelist.com/the-lazarus-group-deathnote-campaign/109490/", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks", "https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/", "https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf", "https://volatility-labs.blogspot.com/2021/10/memory-forensics-r-illustrated.html", @@ -35466,6 +35791,22 @@ "uuid": "a4f8bacf-2076-4e00-863c-874cdd833a41", "value": "MiniASP" }, + { + "description": "miniBlindingCan is an HTTP(S) orchestrator.\r\n\r\nIt is a variant of the BlindingCan RAT, having the same command parsing logic, but supporting only a small subset of commands available previously. The main operations are the update of the malware configuration, and the download and execution of additional payloads from the attackers' C&C.\r\n\r\nThe miniBlindingCan malware was used in Operation DreamJob attacks against aerospace and media companies in Q2-Q3 2022.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.miniblindingcan", + "https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing", + "https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/" + ], + "synonyms": [ + "AIRDRY.V2" + ], + "type": [] + }, + "uuid": "d266693e-0564-47e7-93ac-128d491efcab", + "value": "miniBlindingCan" + }, { "description": "The MiniDuke toolset consists of multiple downloader and backdoor components", "meta": { @@ -35738,6 +36079,20 @@ "uuid": "e33aa1f8-a631-4274-afe0-f2fd3426332e", "value": "MobiRAT" }, + { + "description": "LNK files used to lure and orchestrate execution of various scripts, interacting with the Mocky API service.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.mocky_lnk", + "https://www.zscaler.com/blogs/security-research/steal-it-campaign", + "https://cert.gov.ua/article/4492467" + ], + "synonyms": [], + "type": [] + }, + "uuid": "0eb52072-a2db-4689-bc2d-ac0ae65bdd8c", + "value": "Mocky LNK" + }, { "description": "", "meta": { @@ -36534,6 +36889,7 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore", "https://www.crowdstrike.com/blog/weaponizing-disk-image-files-analysis/", + "https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack", "https://assets.virustotal.com/reports/2021trends.pdf", "https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/how-cybercriminals-abuse-cloud-tunneling-services", "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/", @@ -36550,6 +36906,7 @@ "https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/", "https://community.riskiq.com/article/24759ad2", "https://community.riskiq.com/article/ade260c6", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", "https://www.zscaler.com/blogs/research/multistage-freedom-loader-used-spread-azorult-and-nanocore-rat", "https://zero2auto.com/2020/06/07/dealing-with-obfuscated-macros/", @@ -36718,6 +37075,7 @@ "https://cofense.com/necurs-targeting-banks-pub-file-drops-flawedammyy/", "https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf", "https://blog.trendmicro.com/trendlabs-security-intelligence/the-new-face-of-necurs-noteworthy-changes-to-necurs-behaviors", + "https://www.bitsight.com/blog/joint-effort-with-microsoft-to-takedown-massive-criminal-botnet-necurs", "http://blog.talosintelligence.com/2017/03/necurs-diversifies.html", "https://www.shadowserver.org/news/has-the-sun-set-on-the-necurs-botnet/", "https://blogs.microsoft.com/on-the-issues/2020/03/10/necurs-botnet-cyber-crime-disrupt/", @@ -37023,6 +37381,19 @@ "uuid": "7c6ed154-3232-4b7a-80c3-8052ce0c7333", "value": "Netrepser" }, + { + "description": "Freely available network reconnaissance tool.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.netspy", + "https://github.com/shmilylty/netspy" + ], + "synonyms": [], + "type": [] + }, + "uuid": "a7cc22b7-0d05-480f-b7f8-a6e6c658dd8f", + "value": "NetSpy" + }, { "description": "Enigma Software notes that NetSupport Manager is a genuine application, which was first released about twenty years ago. The purpose of the NetSupport Manager tool is to enable users to receive remote technical support or provide remote computer assistance. However, cyber crooks have hijacked this useful application and misappropriated it to use it in their harmful campaigns. The name of the modified version of the NetSupport Manager has been labeled the NetSupport Manager RAT.", "meta": { @@ -37445,6 +37816,19 @@ "uuid": "5f998c1d-0377-404d-8ece-dd3486758a44", "value": "NimGrabber" }, + { + "description": "Part of Mythic C2, written in Nim. \r\nConsidered deprecated, as it is only compatible with Mythic 2.1.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.nimplant", + "https://github.com/MythicAgents/nimplant" + ], + "synonyms": [], + "type": [] + }, + "uuid": "b8ecda1e-206e-4ab5-b9d7-e50276ba22ea", + "value": "Nimplant" + }, { "description": "Backdoor written in Nim.", "meta": { @@ -37580,6 +37964,7 @@ "https://www.vectra.ai/blogpost/moonlight-middle-east-targeted-attacks", "https://www.blackberry.com/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-bb-2021-threat-report.pdf", "https://www.proofpoint.com/us/blog/threat-insight/reservations-requested-ta558-targets-hospitality-and-travel", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", "https://s3.amazonaws.com/talos-intelligence-site/production/document_files/files/000/095/594/original/Network_IOCs_list_for_coverage.txt?1625657479", "https://asec.ahnlab.com/1369", @@ -38998,12 +39383,15 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.petya", + "https://www.malwarebytes.com/blog/news/2016/06/petya-and-mischa-ransomware-duet-p2", "https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/", "https://securelist.com/petya-the-two-in-one-trojan/74609/", "https://blog.malwarebytes.com/threat-analysis/2016/04/petya-ransomware/", + "https://blogs.blackberry.com/en/2016/07/petya-and-mischa-for-all-part-ii-theyre-here", "https://blog.malwarebytes.com/malwarebytes-news/2017/07/bye-bye-petya-decryptor-old-versions-released/", "https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-1/", "https://www.crowdstrike.com/blog/the-anatomy-of-wiper-malware-part-3/", + "https://blogs.blackberry.com/en/2016/05/petya-and-mischa-for-all-the-raas-boom-expands-to-include-the-petya-mischa-combo", "https://www.trendmicro.com/en_us/research/20/l/the-impact-of-modern-ransomware-on-manufacturing-networks.html", "https://blog.malwarebytes.com/cybercrime/2017/07/keeping-up-with-the-petyas-demystifying-the-malware-family/", "https://blog.malwarebytes.com/threat-analysis/2016/07/third-time-unlucky-improved-petya-is-out/", @@ -39416,6 +39804,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.pirate_stealer", + "https://mostwanted002.page/post/malware-analysis-and-triage-report-piratestealer", "https://mostwanted002.cf/post/malware-analysis-and-triage-report-piratestealer/" ], "synonyms": [], @@ -41283,8 +41672,8 @@ "https://www.bleepingcomputer.com/news/security/qbot-malware-switches-to-new-windows-installer-infection-vector/", "https://www.varonis.com/blog/varonis-discovers-global-cyber-campaign-qbot/", "https://blog.quosec.net/posts/grap_qakbot_navigation/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7", - "https://github.com/prodaft/malware-ioc/blob/master/PTI-66/DarkGate.md", "https://web.archive.org/web/20210305181115/https://cisoclub.ru/doc/otchet-kompanii-group-ib-ransomware-uncovered-2020-2021/?bp-attachment=group-ib_ransomware_uncovered_2020-2021.pdf", "https://www.cybereason.com/blog/threat-analysis-report-all-paths-lead-to-cobalt-strike-icedid-emotet-and-qbot", "https://www.atomicmatryoshka.com/post/malware-headliners-qakbot", @@ -41385,6 +41774,7 @@ "https://www.trendmicro.com/en_us/research/21/c/egregor-ransomware-cartel-members-arrested.html", "https://twitter.com/redcanary/status/1334224861628039169", "https://blog.cyble.com/2023/02/17/the-many-faces-of-qakbot-malware-a-look-at-its-diverse-distribution-methods/", + "https://blog.talosintelligence.com/qakbot-affiliated-actors-distribute-ransom/", "https://www.securityartwork.es/2021/06/16/analisis-campana-emotet/", "https://www.youtube.com/watch?v=gk7fCC5RiAQ", "https://www.fbi.gov/news/stories/fbi-partners-dismantle-qakbot-infrastructure-in-multinational-cyber-takedown", @@ -41453,14 +41843,18 @@ "value": "QuantLoader" }, { - "description": "A stager used by APT29 to download and run CobaltStrike.", + "description": "A stager used by APT29 to download and run CobaltStrike.\r\nHere, MUSKYBEAT refers to the in-memory dropper component, while STATICNOISE is the final payload / downloader.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.quarterrig", + "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://go.recordedfuture.com/hubfs/reports/cta-2023-0727-1.pdf", "https://www.gov.pl/attachment/6f51bb1a-3ad2-461c-a16d-408915a56f77" ], - "synonyms": [], + "synonyms": [ + "MUSKYBEAT", + "STATICNOISE" + ], "type": [] }, "uuid": "ef29604c-1fc8-4f3f-9342-dbb28bb1bd5b", @@ -41513,6 +41907,7 @@ "https://symantec-blogs.broadcom.com/blogs/threat-intelligence/elfin-apt33-espionage", "https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf", "https://www.secureworks.com/research/threat-profiles/aluminum-saratoga", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html", "https://www.zscaler.com/blogs/security-research/look-hydrojiin-campaign", "https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf?platform=hootsuite", @@ -41767,7 +42162,7 @@ "value": "Raccoon" }, { - "description": "", + "description": "Racket Downloader is an HTTP(S) downloader.\r\n\r\nIt uses a custom substitution cipher for decryption of its character strings, and RC5 with a 256-bit key for encryption and decryption of network traffic. \r\n\r\nIt sends an HTTP POST request containing a particular value that inspired its name, like \"?product_field=racket\" or \"prd_fld=racket\".\r\n\r\nRacket Downloader was deployed against South Korean targets running the Initech INISAFE CrossWeb EX software in Q2 2021 and Q1 2022.\r\n", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.racket", @@ -41882,6 +42277,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarok", + "https://www.tarlogic.com/blog/ragnarok-malware-stopper-vaccine/", "https://news.sophos.com/en-us/2022/03/17/the-ransomware-threat-intelligence-center/", "https://news.sophos.com/en-us/2020/05/21/asnarok2/", "https://github.com/k-vitali/Malware-Misc-RE/blob/master/2020-01-26-ragnarok-cfg-vk.notes.raw", @@ -42462,9 +42858,10 @@ "https://cloudsek.com/recordbreaker-the-resurgence-of-raccoon", "https://www.youtube.com/watch?v=NI_Yw2t9zoo", "https://www.zscaler.com/blogs/security-research/raccoon-stealer-v2-latest-generation-raccoon-family", - "https://www.socinvestigation.com/raccoon-infostealer-malware-returns-with-new-ttps-detection-response/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://asec.ahnlab.com/en/52072/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", + "https://www.socinvestigation.com/raccoon-infostealer-malware-returns-with-new-ttps-detection-response/", "https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf", "https://socprime.com/blog/raccoon-stealer-detection-a-novel-malware-version-2-0-named-recordbreaker-offers-hackers-advanced-password-stealing-capabilities/", "https://blog.cyble.com/2022/11/08/massive-youtube-campaign-targeting-over-100-applications-to-deliver-info-stealer/", @@ -42507,6 +42904,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.redcurl", + "https://bi.zone/eng/expertise/blog/red-wolf-vnov-shpionit-za-kommercheskimi-organizatsiyami/", "https://go.group-ib.com/report-redcurl-awakening-en" ], "synonyms": [], @@ -42614,10 +43012,12 @@ "https://www.trendmicro.com/en_us/research/21/i/fake-installers-drop-malware-and-open-doors-for-opportunistic-attackers.html", "https://insight-jp.nttsecurity.com/post/102i7af/steelclovergoogle", "https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://blog.minerva-labs.com/become-a-vip-victim-with-new-discord-distributed-malware", "https://intel471.com/blog/privateloader-malware", "https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/", "https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem", + "https://embee-research.ghost.io/yara-rule-development-il-instructions-in-redline-malware/", "https://www.esentire.com/blog/redline-stealer-masquerades-as-photo-editing-software", "https://unit42.paloaltonetworks.com/bluesky-ransomware/", "https://muha2xmad.github.io/malware-analysis/fullredline/", @@ -42978,7 +43378,9 @@ "https://www.spamhaus.org/news/images/botnet-report-2020-q2/2020-q2-spamhaus-botnet-threat-report.pdf", "https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html", "https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/", + "https://www.zscaler.com/blogs/security-research/latest-version-amadey-introduces-screen-capturing-and-pushes-remcos-rat", "https://github.com/itaymigdal/malware-analysis-writeups/blob/main/Remcos/Remcos.md", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft-defi-communities", "https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/", "https://threatresearch.ext.hp.com/malware-campaigns-targeting-african-banking-sector/", @@ -43189,6 +43591,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.revenge_rat", + "https://embee-research.ghost.io/introduction-to-dotnet-configuration-extraction-revengerat/", "https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/", "https://securelist.com/revengehotels/95229/", "https://www.uptycs.com/blog/revenge-rat-targeting-users-in-south-america", @@ -43574,16 +43977,18 @@ "https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf", "https://threatmon.io/rhadamanthys-stealer-analysis-threatmon/", + "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-resident-campaign", "https://www.zscaler.com/blogs/security-research/technical-analysis-rhadamanthys-obfuscation-techniques", - "https://research.checkpoint.com/2023/from-hidden-bee-to-rhadamanthys-the-evolution-of-custom-executable-formats/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023", + "https://research.checkpoint.com/2023/from-hidden-bee-to-rhadamanthys-the-evolution-of-custom-executable-formats/", "https://www.accenture.com/us-en/blogs/security/information-stealer-malware-on-dark-web", "https://www.secureworks.com/research/the-growing-threat-from-infostealers", "https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88", "https://research.checkpoint.com/2023/rhadamanthys-the-everything-bagel-infostealer/", "https://www.malware-traffic-analysis.net/2023/01/03/index.html", "https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/", - "https://www.esentire.com/blog/esentire-threat-intelligence-malware-analysis-resident-campaign", + "https://outpost24.com/blog/rhadamanthys-malware-analysis/", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf" ], "synonyms": [], @@ -43710,7 +44115,7 @@ "value": "Ripper ATM" }, { - "description": "", + "description": "RisePro is a stealer that is spread through downloaders like win.privateloader. Once executed on a system, the malware can steal credit card information, passwords, and personal data.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.risepro", @@ -44468,6 +44873,7 @@ "https://www.hhs.gov/sites/default/files/bazarloader.pdf", "https://www.huntandhackett.com/blog/advanced-ip-scanner-the-preferred-scanner-in-the-apt-toolbox", "https://securelist.com/story-of-the-year-2019-cities-under-ransomware-siege/95456/", + "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf", "https://thehackernews.com/2022/05/malware-analysis-trickbot.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://symantec.broadcom.com/hubfs/The_Ransomware_Threat_September_2021.pdf", @@ -46063,6 +46469,7 @@ "https://norfolkinfosec.com/some-notes-on-the-silence-proxy/", "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-187a", "https://blog.talosintelligence.com/breaking-the-silence-recent-truebot-activity/", + "https://malware.love/malware_analysis/reverse_engineering/config_extraction/2023/07/13/truebot-config-extractor.html", "https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf", "https://www.group-ib.com/resources/threat-research/silence.html", "https://blogs.vmware.com/security/2023/06/carbon-blacks-truebot-detection.html", @@ -46339,16 +46746,17 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.sliver", - "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf", + "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/", + "https://github.com/chronicle/GCTI", "https://www.telsy.com/download/5900/?uid=b797afdcfb", "https://www.microsoft.com/security/blog/2022/08/24/looking-for-the-sliver-lining-hunting-for-emerging-command-and-control-frameworks", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://michaelkoczwara.medium.com/hunting-c2-with-shodan-223ca250d06f", - "https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide/", "https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf", - "https://research.checkpoint.com/2022/bumblebee-increasing-its-capacity-and-evolving-its-ttps/", "https://github.com/BishopFox/sliver", - "https://github.com/chronicle/GCTI", "https://asec.ahnlab.com/en/47088/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf", + "https://www.immersivelabs.com/blog/detecting-and-decrypting-sliver-c2-a-threat-hunters-guide/", "https://embee-research.ghost.io/shodan-censys-queries/", "https://team-cymru.com/blog/2022/04/29/sliver-case-study-assessing-common-offensive-security-tools/", "https://intel471.com/blog/malware-before-ransomware-trojan-information-stealer-cobalt-strike", @@ -46450,6 +46858,7 @@ "https://blog.vincss.net/2020/12/re018-1-analyzing-new-malware-of-china-panda-hacker-group-used-to-attack-supply-chain-against-vietnam-government-certification-authority.html", "https://labs.sentinelone.com/thundercats-hack-the-fsb-your-taxes-didnt-pay-for-this-op/", "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf", + "https://www.elastic.co/security-labs/introducing-the-ref5961-intrusion-set", "https://insight-jp.nttsecurity.com/post/102glv5/pandas-new-arsenal-part-3-smanager", "https://0xthreatintel.medium.com/how-to-unpack-smanager-apt-tool-cb5909819214", "https://blog.vincss.net/2020/12/re017-2-phan-tich-ky-thuat-dong-ma-doc-moi-co-nhieu-dau-hieu-lien-quan-toi-nhom-tin-tac-Panda.html", @@ -46533,9 +46942,11 @@ "https://www.bleepingcomputer.com/news/security/new-golang-botnet-empties-windows-users-cryptocurrency-wallets/", "https://www.cert.pl/en/news/single/dissecting-smoke-loader/", "https://cloudblogs.microsoft.com/microsoftsecure/2018/04/04/hunting-down-dofoil-with-windows-defender-atp/", - "https://youtu.be/QOypldw6hnY?t=3237", "https://www.intel471.com/blog/Cobalt-strike-cybercriminals-trickbot-qbot-hancitor", + "https://youtu.be/QOypldw6hnY?t=3237", + "https://inside.harfanglab.io/blog/articles/cyber-threat-intelligence/loader-galore-taskloader-at-the-start-of-a-pay-per-install-infection-chain/", "https://m.alvar.es/2020/06/unpacking-smokeloader-and.html", + "https://blog.cluster25.duskrise.com/2023/10/12/cve-2023-38831-russian-attack", "https://www.telekom.com/en/blog/group/article/a-new-way-to-encrypt-cc-server-urls-614886", "https://hatching.io/blog/tt-2020-08-27/", "https://m.alvar.es/2020/06/comparative-analysis-between-bindiff.html", @@ -46935,6 +47346,19 @@ "uuid": "016ea180-ec16-48ce-88ea-c78d8db369d5", "value": "SodaMaster" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.solar", + "https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "1a11c0a9-8ab8-4e98-a7e6-e575eba33c93", + "value": "Solar" + }, { "description": "", "meta": { @@ -47433,6 +47857,24 @@ "uuid": "858a2cdb-9c89-436a-b8d4-60c725c7ac63", "value": "SquirtDanger" }, + { + "description": "sRDI allows for the conversion of DLL files to position independent shellcode. It attempts to be a fully functional PE loader supporting proper section permissions, TLS callbacks, and sanity checks. It can be thought of as a shellcode PE loader strapped to a packed DLL.", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.srdi", + "https://www.mandiant.com/resources/blog/dprk-whatsapp-phishing", + "https://github.com/monoxgas/sRDI", + "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", + "https://www.welivesecurity.com/en/eset-research/lazarus-luring-employees-trojanized-coding-challenges-case-spanish-aerospace-company/" + ], + "synonyms": [ + "DAVESHELL" + ], + "type": [] + }, + "uuid": "90ee25aa-89a8-4d70-a4d8-aee44561a146", + "value": "sRDI" + }, { "description": "", "meta": { @@ -47600,10 +48042,12 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc", "https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://www.esentire.com/blog/stealc-delivered-via-deceptive-google-sheets", "https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/", - "https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_config_extractor.ipynb", - "https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_string_decryption.py" + "https://glyc3rius.github.io/2023/10/stealc/", + "https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_string_decryption.py", + "https://github.com/muha2xmad/Python/blob/bdc7a711d5a775f8ae47b591f20fdd2e1360b77b/Stealc/stealc_config_extractor.ipynb" ], "synonyms": [], "type": [] @@ -47906,24 +48350,25 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.stuxnet", - "https://news.yahoo.com/revealed-how-a-secret-dutch-mole-aided-the-us-israeli-stuxnet-cyber-attack-on-iran-160026018.html", "https://fmmresearch.wordpress.com/2020/09/28/the-emerald-connection-equationgroup-collaboration-with-stuxnet/", "https://www.atlanticcouncil.org/wp-content/uploads/2020/07/Breaking-trust-Shades-of-crisis-across-an-insecure-software-supply-chain.pdf", - "https://www.welivesecurity.com/media_files/white-papers/Stuxnet_Under_the_Microscope.pdf", - "https://medium.com/s2wlab/w3-may-en-story-of-the-week-code-signing-certificate-on-the-darkweb-94c7ec437001", - "https://fmmresearch.files.wordpress.com/2020/09/theemeraldconnectionreport_fmmr-2.pdf", - "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", - "https://storage.googleapis.com/chronicle-research/STUXSHOP%20Stuxnet%20Dials%20In%20.pdf", "https://www.domaintools.com/resources/blog/visibility-monitoring-and-critical-infrastructure-security", - "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf", + "https://web.archive.org/web/20230416140914if_/http://www.chinaview.cn/20230411/4e0fa0f4fd1d408aaddeef8be63a4757/202304114e0fa0f4fd1d408aaddeef8be63a4757_20230411161526_0531.pdf", + "https://media.ccc.de/v/27c3-4245-en-adventures_in_analyzing_stuxnet", + "https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf", + "https://news.yahoo.com/revealed-how-a-secret-dutch-mole-aided-the-us-israeli-stuxnet-cyber-attack-on-iran-160026018.html", + "https://www.welivesecurity.com/media_files/white-papers/Stuxnet_Under_the_Microscope.pdf", + "https://storage.googleapis.com/chronicle-research/STUXSHOP%20Stuxnet%20Dials%20In%20.pdf", "https://www.spiegel.de/netzwelt/web/die-erste-cyberwaffe-und-ihre-folgen-a-a0ed08c9-5080-4ac2-8518-ed69347dc147", "https://www.welivesecurity.com/wp-content/uploads/2021/12/eset_jumping_the_air_gap_wp.pdf", - "https://media.ccc.de/v/27c3-4245-en-adventures_in_analyzing_stuxnet", - "http://artemonsecurity.blogspot.de/2017/04/stuxnet-drivers-detailed-analysis.html", - "https://www.codeproject.com/articles/246545/stuxnet-malware-analysis-paper", "https://symantec.broadcom.com/hubfs/Attacks-Against-Critical_Infrastructrure.pdf", + "https://medium.com/s2wlab/w3-may-en-story-of-the-week-code-signing-certificate-on-the-darkweb-94c7ec437001", + "https://fmmresearch.files.wordpress.com/2020/09/theemeraldconnectionreport_fmmr-2.pdf", + "https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf", + "https://www.codeproject.com/articles/246545/stuxnet-malware-analysis-paper", "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/10/20114955/Bartholomew-GuerreroSaade-VB2016.pdf", - "https://www.crysys.hu/publications/files/tedi/ukatemicrysys_territorialdispute.pdf" + "https://ti.qianxin.com/uploads/2020/02/13/cb78386a082f465f259b37dae5df4884.pdf", + "http://artemonsecurity.blogspot.de/2017/04/stuxnet-drivers-detailed-analysis.html" ], "synonyms": [], "type": [] @@ -48288,6 +48733,7 @@ "https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/", "https://www.solarwinds.com/securityadvisory/faq", "https://us-cert.cisa.gov/ncas/alerts/aa21-008a", + "https://www.cisa.gov/news-events/analysis-reports/ar21-112a", "https://www.trendmicro.com/en_us/research/20/l/overview-of-recent-sunburst-targeted-attacks.html", "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://www.solarwinds.com/securityadvisory", @@ -49550,6 +49996,7 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.tiny_turla", + "https://infosec.exchange/@SophosXOps/111109357153515214", "https://cybergeeks.tech/a-step-by-step-analysis-of-the-russian-apt-turla-backdoor-called-tinyturla/", "https://blog.talosintelligence.com/2021/09/tinyturla.html" ], @@ -49625,6 +50072,7 @@ "https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf", "https://zerophagemalware.com/2017/03/24/terror-ek-delivers-tofsee-spambot/", "https://www.virusbulletin.com/virusbulletin/2014/04/tofsee-botnet", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf", "https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4", "https://intel471.com/blog/privateloader-malware", @@ -49804,7 +50252,7 @@ "value": "TOUCHSHIFT" }, { - "description": "", + "description": "ToxicEye is a ransomware that spreads through phishing emails. The malware encrypts system files with AES-256 and demands a ransom in Bitcoin.", "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.toxiceye", @@ -49957,8 +50405,9 @@ "https://securityintelligence.com/posts/trickbot-gang-template-based-metaprogramming-bazar-malware/", "http://www.malware-traffic-analysis.net/2018/02/01/", "https://mal-eats.net/2021/05/10/campo_new_attack_campaign_targeting_japan/", - "https://www.botconf.eu/wp-content/uploads/2016/11/2016-LT09-TrickBot-Adams.pdf", + "https://strapi.eurepoc.eu/uploads/Eu_Repo_C_APT_profile_Conti_Wizard_Spider_dc2a733e18.pdf", "https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module", + "https://www.botconf.eu/wp-content/uploads/2016/11/2016-LT09-TrickBot-Adams.pdf", "https://www.justice.gov/opa/pr/russian-national-extradited-united-states-face-charges-alleged-role-cybercriminal", "https://f5.com/labs/articles/threat-intelligence/malware/little-trickbot-growing-up-new-campaign-24412", "https://thehackernews.com/2022/05/malware-analysis-trickbot.html", @@ -51309,7 +51758,9 @@ "meta": { "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_106", - "https://www.virustotal.com/gui/file/3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705/detection" + "https://www.virustotal.com/gui/file/3c1cfc2b8b7e5c2d713ec5f329aa58a6b56a08240199761ba6da91e719d30705/detection", + "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/", + "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2023/10/18092216/Updated-MATA-attacks-Eastern-Europe_full-report_ENG.pdf" ], "synonyms": [], "type": [] @@ -51323,10 +51774,13 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_107", "https://lab52.io/blog/2344-2/", + "https://www.mandiant.com/resources/blog/apt29-evolving-diplomatic-phishing", "https://blog.eclecticiq.com/german-embassy-lure-likely-part-of-campaign-against-nato-aligned-ministries-of-foreign-affairs#a3", "https://mp.weixin.qq.com/s?__biz=MzUyMDEyNTkwNA%3D%3D&mid=2247494783&idx=1&sn=612cf3cea1ef62e04bfb6bd0ce3b6b65&chksm=f9ed80c0ce9a09d6f5edc1424df5260cb9a9cf55fe92bd922407eef960650e91ec8cc46933ab&scene=178&cur_album_id=1375769135073951745" ], - "synonyms": [], + "synonyms": [ + "ICEBEAT" + ], "type": [] }, "uuid": "e83a3731-9c84-4e36-a2da-9e6c9c2461d7", @@ -51865,6 +52319,7 @@ "https://threatpost.com/microsoft-help-files-vidar-malware/179078/", "https://eln0ty.github.io/malware%20analysis/vidar/", "https://isc.sans.edu/diary/rss/28468", + "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-2/", "https://blog.cyble.com/2022/11/08/massive-youtube-campaign-targeting-over-100-applications-to-deliver-info-stealer/", "https://asec.ahnlab.com/en/30875/", "https://asec.ahnlab.com/en/22932/", @@ -51877,6 +52332,7 @@ "https://blog.jaalma.io/vidar-infostealer-analysis/", "https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/", "https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/", + "https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf", "https://www.esentire.com/blog/batloader-continues-to-abuse-google-search-ads-to-deliver-vidar-stealer-and-ursnif", "https://www.secureworks.com/research/the-growing-threat-from-infostealers", "https://kienmanowar.wordpress.com/2022/12/17/quicknote-vidarstealer-analysis/", @@ -51888,6 +52344,7 @@ "https://blog.sekoia.io/traffers-a-deep-dive-into-the-information-stealer-ecosystem", "https://www.cynet.com/blog/cyops-lighthouse-vidar-stealer/", "https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign", + "https://xer0xe9.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/", "https://www.quorumcyber.com/wp-content/uploads/2023/01/Malware-Analysis-Vidar.pdf", "https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/", "https://twitter.com/sisoma2/status/1409816282065743872", @@ -52885,6 +53342,7 @@ "refs": [ "https://malpedia.caad.fkie.fraunhofer.de/details/win.wikiloader", "https://twitter.com/threatinsight/status/1679864625544978432", + "https://twitter.com/JAMESWT_MHT/status/1712783250446328114?t=iLKXzsZuS1TTa0i9sZFkQA&s=19", "https://www.proofpoint.com/us/blog/threat-insight/out-sandbox-wikiloader-digs-sophisticated-evasion" ], "synonyms": [ @@ -53458,6 +53916,19 @@ "uuid": "ba99edf0-1603-4f54-8fa9-18852417d0fc", "value": "XFSCashNCR" }, + { + "description": "", + "meta": { + "refs": [ + "https://malpedia.caad.fkie.fraunhofer.de/details/win.xiangoop", + "https://www.virusbulletin.com/conference/vb2023/abstracts/unveiling-activities-tropic-trooper-2023-deep-analysis-xiangoop-loader-and-entryshell-payload/" + ], + "synonyms": [], + "type": [] + }, + "uuid": "b61903a1-51e6-493c-885f-6ffda99371ea", + "value": "Xiangoop" + }, { "description": "Ransomware.", "meta": { @@ -54682,5 +55153,5 @@ "value": "Zyklon" } ], - "version": 19000 + "version": 19171 } From aa5a6eb062bc033220e4e5257b6600cabec53aed Mon Sep 17 00:00:00 2001 From: jstnk9 Date: Thu, 19 Oct 2023 12:39:37 +0200 Subject: [PATCH 07/20] threat actor updated --- clusters/threat-actor.json | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index e271473..f02dd15 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -6190,7 +6190,8 @@ "https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWMFIi", "https://decoded.avast.io/threatintel/outbreak-of-follina-in-australia", "https://www.proofpoint.com/us/blog/threat-insight/chasing-currents-espionage-south-china-sea", - "https://www.accenture.com/_acnmedia/pdf-96/accenture-security-mudcarp.pdf" + "https://www.accenture.com/_acnmedia/pdf-96/accenture-security-mudcarp.pdf", + "https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/" ], "synonyms": [ "TEMP.Periscope", @@ -6204,7 +6205,8 @@ "TA423", "Red Ladon", "ITG09", - "MUDCARP" + "MUDCARP", + "ISLANDDREAMS" ] }, "related": [ From ec9dc0f2e31461981df16d9ff6492316b755ec8d Mon Sep 17 00:00:00 2001 From: jstnk9 Date: Fri, 20 Oct 2023 11:51:13 +0200 Subject: [PATCH 08/20] threat actors update --- clusters/threat-actor.json | 47 +++++++++++++++++++++++++++++++++++++- 1 file changed, 46 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index f02dd15..b1836dd 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -209,6 +209,30 @@ "uuid": "8a8f39df-74b3-4946-ab64-f84968bababe", "value": "DIZZY PANDA" }, + { + "description": "Grayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-loading activity. Grayling appears to target organisations in Asia, however one unknown organisation in the United States was also targeted. Industries targeted include Biomedical, Government and Information Technology. Grayling use a variety of tools during their attacks, including well known tools such as Cobalt Strike and Havoc and also some others.", + "meta": { + "attribution-confidence": "50", + "country": "CN", + "cfr-suspected-state-sponsor": "China", + "refs": [ + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks" + ], + "cfr-suspected-victims": [ + "Taiwan", + "United States", + "Vietnam", + "Solomon Islands" + ], + "cfr-target-category": [ + "Biomedical", + "Government", + "Information technology" + ] + }, + "uuid": "6714de29-4dd8-463c-99a3-77c9e80fa47d", + "value": "Grayling" + }, { "description": "Putter Panda were the subject of an extensive report by CrowdStrike, which stated: 'The CrowdStrike Intelligence team has been tracking this particular unit since2012, under the codename PUTTER PANDA, and has documented activity dating back to 2007. The report identifies Chen Ping, aka cpyy, and the primary location of Unit 61486.'", "meta": { @@ -7531,7 +7555,28 @@ "description": "Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.", "meta": { "refs": [ - "https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/" + "https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/", + "https://www.ecucert.gob.ec/wp-content/uploads/2022/03/alerta-APTs-2022-03-23.pdf", + "https://blogs.blackberry.com/en/2023/02/blind-eagle-apt-c-36-targets-colombia", + "https://lab52.io/blog/apt-c-36-recent-activity-analysis/", + "https://www.trendmicro.com/en_ph/research/21/i/apt-c-36-updates-its-long-term-spam-campaign-against-south-ameri.html", + "https://research.checkpoint.com/2023/blindeagle-targeting-ecuador-with-sharpened-tools/", + "https://attack.mitre.org/groups/G0099/" + ], + "cfr-suspected-victims": [ + "Ecuador", + "Colombia", + "Spain", + "Panama", + "Chile" + ], + "cfr-type-of-incident": "Espionage", + "cfr-target-category": [ + "Petroleum", + "Manufacturing", + "Financial", + "Private sector", + "Government" ], "synonyms": [ "Blind Eagle" From 416cd6706ae471ed8eab950c3d7769d032ff2c62 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Fri, 20 Oct 2023 12:00:48 +0200 Subject: [PATCH 09/20] fix: [threat-actor] JQ all the things + version updated --- clusters/threat-actor.json | 40 +++++++++++++++++++------------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index b1836dd..afb158a 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -213,11 +213,7 @@ "description": "Grayling activity was first observed in early 2023, when a number of victims were identified with distinctive malicious DLL side-loading activity. Grayling appears to target organisations in Asia, however one unknown organisation in the United States was also targeted. Industries targeted include Biomedical, Government and Information Technology. Grayling use a variety of tools during their attacks, including well known tools such as Cobalt Strike and Havoc and also some others.", "meta": { "attribution-confidence": "50", - "country": "CN", "cfr-suspected-state-sponsor": "China", - "refs": [ - "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks" - ], "cfr-suspected-victims": [ "Taiwan", "United States", @@ -228,6 +224,10 @@ "Biomedical", "Government", "Information technology" + ], + "country": "CN", + "refs": [ + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/grayling-taiwan-cyber-attacks" ] }, "uuid": "6714de29-4dd8-463c-99a3-77c9e80fa47d", @@ -7554,6 +7554,21 @@ { "description": "Since April 2018, an APT group (Blind Eagle, APT-C-36) suspected coming from South America carried out continuous targeted attacks against Colombian government institutions as well as important corporations in financial sector, petroleum industry, professional manufacturing, etc.", "meta": { + "cfr-suspected-victims": [ + "Ecuador", + "Colombia", + "Spain", + "Panama", + "Chile" + ], + "cfr-target-category": [ + "Petroleum", + "Manufacturing", + "Financial", + "Private sector", + "Government" + ], + "cfr-type-of-incident": "Espionage", "refs": [ "https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/", "https://www.ecucert.gob.ec/wp-content/uploads/2022/03/alerta-APTs-2022-03-23.pdf", @@ -7563,21 +7578,6 @@ "https://research.checkpoint.com/2023/blindeagle-targeting-ecuador-with-sharpened-tools/", "https://attack.mitre.org/groups/G0099/" ], - "cfr-suspected-victims": [ - "Ecuador", - "Colombia", - "Spain", - "Panama", - "Chile" - ], - "cfr-type-of-incident": "Espionage", - "cfr-target-category": [ - "Petroleum", - "Manufacturing", - "Financial", - "Private sector", - "Government" - ], "synonyms": [ "Blind Eagle" ] @@ -12049,5 +12049,5 @@ "value": "Void Rabisu" } ], - "version": 286 + "version": 287 } From dcde7060789071a1d73601a1816636ff5ae1eade Mon Sep 17 00:00:00 2001 From: Mathieu Beligon Date: Thu, 26 Oct 2023 13:14:20 +0200 Subject: [PATCH 10/20] [threat-actors] Add Camaro Dragon --- clusters/threat-actor.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index afb158a..80133a3 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -12047,6 +12047,18 @@ ], "uuid": "9766d52e-0e5d-4997-9c31-7f2291dcda9e", "value": "Void Rabisu" + }, + { + "description": "In early 2023, the Check Point Incident Response Team (CPIRT) team investigated a malware incident at a European healthcare institution involving a set of tools mentioned in the Avast report in late 2022. The incident was attributed to Camaro Dragon, a Chinese-based espionage threat actor whose activities overlap with activities tracked by different researchers as Mustang Panda and LuminousMoth, whose focus is primarily on Southeast Asian countries and their close peers.", + "meta": { + "country": "CN", + "references": [ + "https://research.checkpoint.com/2023/the-dragon-who-sold-his-camaro-analyzing-custom-router-implant/", + "https://research.checkpoint.com/2023/beyond-the-horizon-traveling-the-world-on-camaro-dragons-usb-flash-drives/" + ] + }, + "uuid": "9ee446fd-b0cd-4662-9cd1-a60b429192db", + "value": "Camaro Dragon" } ], "version": 287 From 0f9646f844649e16f026b3167347b3931ef2532a Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 30 Oct 2023 14:21:30 +0100 Subject: [PATCH 11/20] Add NAICS galaxy --- clusters/naics.json | 51100 ++++++++++++++++++++++++++++++++++++++++++ galaxies/naics.json | 9 + 2 files changed, 51109 insertions(+) create mode 100644 clusters/naics.json create mode 100644 galaxies/naics.json diff --git a/clusters/naics.json b/clusters/naics.json new file mode 100644 index 0000000..ab985bb --- /dev/null +++ b/clusters/naics.json @@ -0,0 +1,51100 @@ +{ + "description": "The North American Industry Classification System or NAICS is a classification of business establishments by type of economic activity (the process of production).", + "name": "NAICS", + "source": "North American Industry Classification System - NAICS", + "type": "naics", + "uuid": "b73ecad4-6529-4625-8c4f-ee3ef703a72a", + "values": [ + { + "description": "Agriculture, Forestry, Fishing and Hunting", + "related": [ + { + "dest-uuid": "0937058e-8d81-469e-980a-93a52e13cfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bbcb8b8b-655b-483e-ba16-a4d5f65fa9a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1eeb2b8-84bf-488b-99c4-46519f4911c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "602b67ae-a729-495c-8e67-e50b94d193f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1030235b-86c8-4c20-b115-61aba9d6c4ff", + "value": "11" + }, + { + "description": "Crop Production", + "related": [ + { + "dest-uuid": "1030235b-86c8-4c20-b115-61aba9d6c4ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9b088cdc-c879-46d1-bd30-db7d2287fee9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0937058e-8d81-469e-980a-93a52e13cfd6", + "value": "111" + }, + { + "description": "Oilseed and Grain Farming", + "related": [ + { + "dest-uuid": "0937058e-8d81-469e-980a-93a52e13cfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eb8b6d5c-574c-42aa-bd06-0530c93d1058", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "63274656-bbec-4c49-bcc1-386fc45817e2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ba9019ee-c79d-4ca2-aff1-8560dabd0edb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b396ab08-fe62-4590-9174-6ff4ecc8747b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bedd29bc-a41b-47a1-936f-b46e68f8622a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c8aee2f4-fc8d-4282-addb-bad28d1d5196", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cb7ab675-df37-4e60-ab5e-90b77627fa13", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fdd8e731-f07a-46da-ae8b-386f674ec14c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2b155e4c-461a-4ff5-8072-e4dcfe433222", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "141b04eb-ecb1-4a18-8e49-267d987b7a1b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "14fd5430-f169-431a-8fd4-7658ae6adb48", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b7f85117-1068-43c2-ba17-f145c2f225f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8b544c48-7d73-40ea-8639-044cb430202c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "27ebd6ca-6886-4028-b1cc-fc091d1502c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bc9cb477-e638-40a8-8944-6b4af04fb72f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "value": "1111" + }, + { + "description": "Soybean Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "63274656-bbec-4c49-bcc1-386fc45817e2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eb8b6d5c-574c-42aa-bd06-0530c93d1058", + "value": "11111" + }, + { + "description": "Soybean Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eb8b6d5c-574c-42aa-bd06-0530c93d1058", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "63274656-bbec-4c49-bcc1-386fc45817e2", + "value": "111110" + }, + { + "description": "Oilseed (except Soybean) Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b396ab08-fe62-4590-9174-6ff4ecc8747b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ba9019ee-c79d-4ca2-aff1-8560dabd0edb", + "value": "11112" + }, + { + "description": "Oilseed (except Soybean) Farming ", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ba9019ee-c79d-4ca2-aff1-8560dabd0edb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b396ab08-fe62-4590-9174-6ff4ecc8747b", + "value": "111120" + }, + { + "description": "Dry Pea and Bean Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8aee2f4-fc8d-4282-addb-bad28d1d5196", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bedd29bc-a41b-47a1-936f-b46e68f8622a", + "value": "11113" + }, + { + "description": "Dry Pea and Bean Farming ", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bedd29bc-a41b-47a1-936f-b46e68f8622a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c8aee2f4-fc8d-4282-addb-bad28d1d5196", + "value": "111130" + }, + { + "description": "Wheat Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fdd8e731-f07a-46da-ae8b-386f674ec14c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cb7ab675-df37-4e60-ab5e-90b77627fa13", + "value": "11114" + }, + { + "description": "Wheat Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cb7ab675-df37-4e60-ab5e-90b77627fa13", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fdd8e731-f07a-46da-ae8b-386f674ec14c", + "value": "111140" + }, + { + "description": "Corn Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "141b04eb-ecb1-4a18-8e49-267d987b7a1b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2b155e4c-461a-4ff5-8072-e4dcfe433222", + "value": "11115" + }, + { + "description": "Corn Farming ", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b155e4c-461a-4ff5-8072-e4dcfe433222", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "141b04eb-ecb1-4a18-8e49-267d987b7a1b", + "value": "111150" + }, + { + "description": "Rice Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b7f85117-1068-43c2-ba17-f145c2f225f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "14fd5430-f169-431a-8fd4-7658ae6adb48", + "value": "11116" + }, + { + "description": "Rice Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "14fd5430-f169-431a-8fd4-7658ae6adb48", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b7f85117-1068-43c2-ba17-f145c2f225f4", + "value": "111160" + }, + { + "description": "Other Grain Farming", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8b544c48-7d73-40ea-8639-044cb430202c", + "value": "11119" + }, + { + "description": "Oilseed and Grain Combination Farming ", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "27ebd6ca-6886-4028-b1cc-fc091d1502c3", + "value": "111191" + }, + { + "description": "All Other Grain Farming ", + "related": [ + { + "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bc9cb477-e638-40a8-8944-6b4af04fb72f", + "value": "111199" + }, + { + "description": "Vegetable and Melon Farming", + "related": [ + { + "dest-uuid": "0937058e-8d81-469e-980a-93a52e13cfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eee6559e-b386-4821-a3a3-5693f02c77e2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3eff8995-ee4e-4e11-a99c-aac4df706ecd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "98885e9e-8d2c-430a-9aab-d8ad94019adb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9b088cdc-c879-46d1-bd30-db7d2287fee9", + "value": "1112" + }, + { + "description": "Vegetable and Melon Farming", + "related": [ + { + "dest-uuid": "9b088cdc-c879-46d1-bd30-db7d2287fee9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "eee6559e-b386-4821-a3a3-5693f02c77e2", + "value": "11121" + }, + { + "description": "Potato Farming ", + "related": [ + { + "dest-uuid": "9b088cdc-c879-46d1-bd30-db7d2287fee9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3eff8995-ee4e-4e11-a99c-aac4df706ecd", + "value": "111211" + }, + { + "description": "Other Vegetable (except Potato) and Melon Farming ", + "related": [ + { + "dest-uuid": "9b088cdc-c879-46d1-bd30-db7d2287fee9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "98885e9e-8d2c-430a-9aab-d8ad94019adb", + "value": "111219" + }, + { + "description": "Fruit and Tree Nut Farming", + "related": [ + { + "dest-uuid": "0937058e-8d81-469e-980a-93a52e13cfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1fb4877a-85be-4c31-bb52-50d7b7b63867", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e6bf872f-18dd-44ee-95cd-f11e18488de7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9e95dd38-46a6-44ec-b19d-871bc7d6d18a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "99e6a9dd-436a-4212-95df-36fb73e5b7b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "463ffc24-7ba9-4f82-8c7a-294dc5b63da0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c114b81e-1f6a-4b9c-b119-22f946e6ed02", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "75003aa5-a842-4d32-805f-e08825a7a982", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "02977b10-be56-4b59-a59e-fe09c5ec29f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "36f96049-ec02-4bb5-96ee-9da30cc057a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5954c57a-38e4-43fd-8f79-d61d3b1f822f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eec09b48-423e-4fb2-98ee-3576e4b6dacc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fa53cdca-d43d-4f28-89b4-4fa887d58df2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "value": "1113" + }, + { + "description": "Orange Groves", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e6bf872f-18dd-44ee-95cd-f11e18488de7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1fb4877a-85be-4c31-bb52-50d7b7b63867", + "value": "11131" + }, + { + "description": "Orange Groves", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1fb4877a-85be-4c31-bb52-50d7b7b63867", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e6bf872f-18dd-44ee-95cd-f11e18488de7", + "value": "111310" + }, + { + "description": "Citrus (except Orange) Groves", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "99e6a9dd-436a-4212-95df-36fb73e5b7b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9e95dd38-46a6-44ec-b19d-871bc7d6d18a", + "value": "11132" + }, + { + "description": "Citrus (except Orange) Groves ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9e95dd38-46a6-44ec-b19d-871bc7d6d18a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "99e6a9dd-436a-4212-95df-36fb73e5b7b4", + "value": "111320" + }, + { + "description": "Noncitrus Fruit and Tree Nut Farming", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "463ffc24-7ba9-4f82-8c7a-294dc5b63da0", + "value": "11133" + }, + { + "description": "Apple Orchards ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c114b81e-1f6a-4b9c-b119-22f946e6ed02", + "value": "111331" + }, + { + "description": "Grape Vineyards ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "75003aa5-a842-4d32-805f-e08825a7a982", + "value": "111332" + }, + { + "description": "Strawberry Farming ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "02977b10-be56-4b59-a59e-fe09c5ec29f8", + "value": "111333" + }, + { + "description": "Berry (except Strawberry) Farming ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "36f96049-ec02-4bb5-96ee-9da30cc057a6", + "value": "111334" + }, + { + "description": "Tree Nut Farming ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5954c57a-38e4-43fd-8f79-d61d3b1f822f", + "value": "111335" + }, + { + "description": "Fruit and Tree Nut Combination Farming ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "eec09b48-423e-4fb2-98ee-3576e4b6dacc", + "value": "111336" + }, + { + "description": "Other Noncitrus Fruit Farming ", + "related": [ + { + "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fa53cdca-d43d-4f28-89b4-4fa887d58df2", + "value": "111339" + }, + { + "description": "Greenhouse, Nursery, and Floriculture Production", + "related": [ + { + "dest-uuid": "0937058e-8d81-469e-980a-93a52e13cfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "133d8144-26a0-4a3e-a7e7-67c559c2e0ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f05fd978-c556-4ef7-87e2-ed018f30a221", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f92baed0-68eb-4477-afa4-8ae324ec4352", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d7ecbdd-268a-4962-84db-55b639f8e966", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a53f35cd-3d94-413b-8b02-acd794f88b11", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9d411c0e-6ebc-4a5f-98a6-9a541f909377", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "value": "1114" + }, + { + "description": "Food Crops Grown Under Cover", + "related": [ + { + "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "133d8144-26a0-4a3e-a7e7-67c559c2e0ff", + "value": "11141" + }, + { + "description": "Mushroom Production ", + "related": [ + { + "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f05fd978-c556-4ef7-87e2-ed018f30a221", + "value": "111411" + }, + { + "description": "Other Food Crops Grown Under Cover ", + "related": [ + { + "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f92baed0-68eb-4477-afa4-8ae324ec4352", + "value": "111419" + }, + { + "description": "Nursery and Floriculture Production", + "related": [ + { + "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3d7ecbdd-268a-4962-84db-55b639f8e966", + "value": "11142" + }, + { + "description": "Nursery and Tree Production ", + "related": [ + { + "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a53f35cd-3d94-413b-8b02-acd794f88b11", + "value": "111421" + }, + { + "description": "Floriculture Production ", + "related": [ + { + "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9d411c0e-6ebc-4a5f-98a6-9a541f909377", + "value": "111422" + }, + { + "description": "Other Crop Farming", + "related": [ + { + "dest-uuid": "0937058e-8d81-469e-980a-93a52e13cfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2588d523-3d89-4de9-9474-bc146fe913e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "50ff6e42-5b6b-42d0-8a46-1206855a105a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d734cb63-020d-49e3-915c-301d6969fbb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2480d016-d457-42fb-9b3c-437bf8afb5e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "80254bea-600a-48c2-97e7-5f6289360f8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6fa893d4-9409-49c3-9d5f-fd8b6a3e2e0d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "06b2797b-b0e6-46d8-ada8-866908461d05", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "32edb0f6-1cef-4c49-adf8-c348f6a8b19f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8f16d3dd-b3a9-4b95-a576-a807db95ed38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c4ad2e16-c142-463f-a377-221c4414ff43", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "397eb12b-8a8c-4b37-b17e-e88929185411", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8f763554-2153-4d0c-90e3-0d617267da7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "value": "1119" + }, + { + "description": "Tobacco Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "50ff6e42-5b6b-42d0-8a46-1206855a105a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2588d523-3d89-4de9-9474-bc146fe913e6", + "value": "11191" + }, + { + "description": "Tobacco Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2588d523-3d89-4de9-9474-bc146fe913e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "50ff6e42-5b6b-42d0-8a46-1206855a105a", + "value": "111910" + }, + { + "description": "Cotton Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2480d016-d457-42fb-9b3c-437bf8afb5e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d734cb63-020d-49e3-915c-301d6969fbb8", + "value": "11192" + }, + { + "description": "Cotton Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d734cb63-020d-49e3-915c-301d6969fbb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2480d016-d457-42fb-9b3c-437bf8afb5e5", + "value": "111920" + }, + { + "description": "Sugarcane Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6fa893d4-9409-49c3-9d5f-fd8b6a3e2e0d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "80254bea-600a-48c2-97e7-5f6289360f8e", + "value": "11193" + }, + { + "description": "Sugarcane Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "80254bea-600a-48c2-97e7-5f6289360f8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6fa893d4-9409-49c3-9d5f-fd8b6a3e2e0d", + "value": "111930" + }, + { + "description": "Hay Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "32edb0f6-1cef-4c49-adf8-c348f6a8b19f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "06b2797b-b0e6-46d8-ada8-866908461d05", + "value": "11194" + }, + { + "description": "Hay Farming ", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "06b2797b-b0e6-46d8-ada8-866908461d05", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "32edb0f6-1cef-4c49-adf8-c348f6a8b19f", + "value": "111940" + }, + { + "description": "All Other Crop Farming", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8f16d3dd-b3a9-4b95-a576-a807db95ed38", + "value": "11199" + }, + { + "description": "Sugar Beet Farming ", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c4ad2e16-c142-463f-a377-221c4414ff43", + "value": "111991" + }, + { + "description": "Peanut Farming ", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "397eb12b-8a8c-4b37-b17e-e88929185411", + "value": "111992" + }, + { + "description": "All Other Miscellaneous Crop Farming ", + "related": [ + { + "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8f763554-2153-4d0c-90e3-0d617267da7f", + "value": "111998" + }, + { + "description": "Animal Production and Aquaculture", + "related": [ + { + "dest-uuid": "1030235b-86c8-4c20-b115-61aba9d6c4ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8b7370fe-bec7-4b73-8775-bb39417f4ee5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "137611c7-189c-4b07-83e8-5081de07a230", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "value": "112" + }, + { + "description": "Cattle Ranching and Farming", + "related": [ + { + "dest-uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1caf1da5-2b15-4a07-85c7-158687215666", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "639b7a1d-cabe-44f1-8c1a-74ea8d50da8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5cda9765-aaf8-455a-b366-0aa04f2f9c46", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "98e01dd7-58e2-4a08-afd7-9263c09387a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f60abbba-3491-4ecd-9760-8353138f6842", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "45b3b0a9-fa6b-45df-9335-5e2eb72a5163", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0368841b-f5ab-4d66-93fa-4497705f81dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "value": "1121" + }, + { + "description": "Beef Cattle Ranching and Farming, including Feedlots", + "related": [ + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1caf1da5-2b15-4a07-85c7-158687215666", + "value": "11211" + }, + { + "description": "Beef Cattle Ranching and Farming ", + "related": [ + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "639b7a1d-cabe-44f1-8c1a-74ea8d50da8e", + "value": "112111" + }, + { + "description": "Cattle Feedlots ", + "related": [ + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5cda9765-aaf8-455a-b366-0aa04f2f9c46", + "value": "112112" + }, + { + "description": "Dairy Cattle and Milk Production", + "related": [ + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f60abbba-3491-4ecd-9760-8353138f6842", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "98e01dd7-58e2-4a08-afd7-9263c09387a6", + "value": "11212" + }, + { + "description": "Dairy Cattle and Milk Production", + "related": [ + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "98e01dd7-58e2-4a08-afd7-9263c09387a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f60abbba-3491-4ecd-9760-8353138f6842", + "value": "112120" + }, + { + "description": "Dual-Purpose Cattle Ranching and Farming", + "related": [ + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0368841b-f5ab-4d66-93fa-4497705f81dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "45b3b0a9-fa6b-45df-9335-5e2eb72a5163", + "value": "11213" + }, + { + "description": "Dual-Purpose Cattle Ranching and Farming ", + "related": [ + { + "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "45b3b0a9-fa6b-45df-9335-5e2eb72a5163", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0368841b-f5ab-4d66-93fa-4497705f81dc", + "value": "112130" + }, + { + "description": "Hog and Pig Farming", + "related": [ + { + "dest-uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7fa33b8b-dc69-4ec2-b58d-c36053482595", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "18821d73-1cc2-4486-8d95-477c5e7ea166", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8b7370fe-bec7-4b73-8775-bb39417f4ee5", + "value": "1122" + }, + { + "description": "Hog and Pig Farming", + "related": [ + { + "dest-uuid": "8b7370fe-bec7-4b73-8775-bb39417f4ee5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "18821d73-1cc2-4486-8d95-477c5e7ea166", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7fa33b8b-dc69-4ec2-b58d-c36053482595", + "value": "11221" + }, + { + "description": "Hog and Pig Farming ", + "related": [ + { + "dest-uuid": "8b7370fe-bec7-4b73-8775-bb39417f4ee5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7fa33b8b-dc69-4ec2-b58d-c36053482595", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "18821d73-1cc2-4486-8d95-477c5e7ea166", + "value": "112210" + }, + { + "description": "Poultry and Egg Production", + "related": [ + { + "dest-uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4b2f0e08-3fe2-4fc7-bf84-964ff013d7b5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ee9db03b-754c-4f19-b12a-82ef7826c02a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "886d34c6-a3fd-41c2-8fa9-bee860e4dace", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "94416cef-29bc-49f5-a093-9dab0c86a18a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "454e8052-ab4a-4360-b817-a8ef819fd2ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1eb61c9e-258a-4db4-bca0-d2f3ed5464c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ff8587c4-91ff-4a56-b4a1-059eae437c89", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "14acc41d-d9bf-4c3d-809a-e1998ee54c7a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d409eb3-c4f7-43a7-af8e-816262148303", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dc116cd8-9eae-4b77-8637-f83253b03301", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "value": "1123" + }, + { + "description": "Chicken Egg Production", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ee9db03b-754c-4f19-b12a-82ef7826c02a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4b2f0e08-3fe2-4fc7-bf84-964ff013d7b5", + "value": "11231" + }, + { + "description": "Chicken Egg Production ", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4b2f0e08-3fe2-4fc7-bf84-964ff013d7b5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ee9db03b-754c-4f19-b12a-82ef7826c02a", + "value": "112310" + }, + { + "description": "Broilers and Other Meat Type Chicken Production", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "94416cef-29bc-49f5-a093-9dab0c86a18a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "886d34c6-a3fd-41c2-8fa9-bee860e4dace", + "value": "11232" + }, + { + "description": "Broilers and Other Meat Type Chicken Production ", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "886d34c6-a3fd-41c2-8fa9-bee860e4dace", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "94416cef-29bc-49f5-a093-9dab0c86a18a", + "value": "112320" + }, + { + "description": "Turkey Production", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1eb61c9e-258a-4db4-bca0-d2f3ed5464c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "454e8052-ab4a-4360-b817-a8ef819fd2ad", + "value": "11233" + }, + { + "description": "Turkey Production", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "454e8052-ab4a-4360-b817-a8ef819fd2ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1eb61c9e-258a-4db4-bca0-d2f3ed5464c1", + "value": "112330" + }, + { + "description": "Poultry Hatcheries", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "14acc41d-d9bf-4c3d-809a-e1998ee54c7a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ff8587c4-91ff-4a56-b4a1-059eae437c89", + "value": "11234" + }, + { + "description": "Poultry Hatcheries", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ff8587c4-91ff-4a56-b4a1-059eae437c89", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "14acc41d-d9bf-4c3d-809a-e1998ee54c7a", + "value": "112340" + }, + { + "description": "Other Poultry Production", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dc116cd8-9eae-4b77-8637-f83253b03301", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7d409eb3-c4f7-43a7-af8e-816262148303", + "value": "11239" + }, + { + "description": "Other Poultry Production ", + "related": [ + { + "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7d409eb3-c4f7-43a7-af8e-816262148303", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dc116cd8-9eae-4b77-8637-f83253b03301", + "value": "112390" + }, + { + "description": "Sheep and Goat Farming", + "related": [ + { + "dest-uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eef1f038-1553-45e2-b792-66d18dabe125", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a78269c3-6574-4c20-b51d-f6dbea12a5e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ed89f746-e353-45d9-bba5-e745f263c514", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ca261003-8dfd-4970-85a7-e583e1c8d09e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "137611c7-189c-4b07-83e8-5081de07a230", + "value": "1124" + }, + { + "description": "Sheep Farming", + "related": [ + { + "dest-uuid": "137611c7-189c-4b07-83e8-5081de07a230", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a78269c3-6574-4c20-b51d-f6dbea12a5e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eef1f038-1553-45e2-b792-66d18dabe125", + "value": "11241" + }, + { + "description": "Sheep Farming", + "related": [ + { + "dest-uuid": "137611c7-189c-4b07-83e8-5081de07a230", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eef1f038-1553-45e2-b792-66d18dabe125", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a78269c3-6574-4c20-b51d-f6dbea12a5e6", + "value": "112410" + }, + { + "description": "Goat Farming", + "related": [ + { + "dest-uuid": "137611c7-189c-4b07-83e8-5081de07a230", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ca261003-8dfd-4970-85a7-e583e1c8d09e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ed89f746-e353-45d9-bba5-e745f263c514", + "value": "11242" + }, + { + "description": "Goat Farming", + "related": [ + { + "dest-uuid": "137611c7-189c-4b07-83e8-5081de07a230", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ed89f746-e353-45d9-bba5-e745f263c514", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ca261003-8dfd-4970-85a7-e583e1c8d09e", + "value": "112420" + }, + { + "description": "Aquaculture", + "related": [ + { + "dest-uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ca2c65f1-5e24-46c0-9408-256c80abdc0f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a1049f9a-9871-469d-b82a-3f2a2ad4018f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "834715d6-6474-4dfb-a060-a34ae739b381", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "622c5f27-0a3d-4a05-a34c-b378836e017b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", + "value": "1125" + }, + { + "description": "Aquaculture", + "related": [ + { + "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ca2c65f1-5e24-46c0-9408-256c80abdc0f", + "value": "11251" + }, + { + "description": "Finfish Farming and Fish Hatcheries ", + "related": [ + { + "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a1049f9a-9871-469d-b82a-3f2a2ad4018f", + "value": "112511" + }, + { + "description": "Shellfish Farming ", + "related": [ + { + "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "834715d6-6474-4dfb-a060-a34ae739b381", + "value": "112512" + }, + { + "description": "Other Aquaculture ", + "related": [ + { + "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "622c5f27-0a3d-4a05-a34c-b378836e017b", + "value": "112519" + }, + { + "description": "Other Animal Production", + "related": [ + { + "dest-uuid": "445babd9-2930-41f2-b0a6-d75d7e6e4b1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cd80c614-4236-4842-b43c-0b50122b4749", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fe6dbb43-2e9a-47f7-861b-9e40ed251f2c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b8e16e8e-fa02-4dbc-a412-f892c60dc59d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fdb9670b-0a8f-45a5-a70b-bbe936cce9d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a2b693ef-817a-4059-9242-65654581f65e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b13d290e-270d-407d-9367-1a9d7b2110c0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1e1d869-90a5-4386-bf91-c41bd17224ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "51637833-1132-4f7e-9936-d6172e9fefaf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "value": "1129" + }, + { + "description": "Apiculture", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fe6dbb43-2e9a-47f7-861b-9e40ed251f2c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cd80c614-4236-4842-b43c-0b50122b4749", + "value": "11291" + }, + { + "description": "Apiculture", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cd80c614-4236-4842-b43c-0b50122b4749", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fe6dbb43-2e9a-47f7-861b-9e40ed251f2c", + "value": "112910" + }, + { + "description": "Horses and Other Equine Production", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fdb9670b-0a8f-45a5-a70b-bbe936cce9d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b8e16e8e-fa02-4dbc-a412-f892c60dc59d", + "value": "11292" + }, + { + "description": "Horses and Other Equine Production", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b8e16e8e-fa02-4dbc-a412-f892c60dc59d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fdb9670b-0a8f-45a5-a70b-bbe936cce9d5", + "value": "112920" + }, + { + "description": "Fur-Bearing Animal and Rabbit Production", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b13d290e-270d-407d-9367-1a9d7b2110c0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a2b693ef-817a-4059-9242-65654581f65e", + "value": "11293" + }, + { + "description": "Fur-Bearing Animal and Rabbit Production", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a2b693ef-817a-4059-9242-65654581f65e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b13d290e-270d-407d-9367-1a9d7b2110c0", + "value": "112930" + }, + { + "description": "All Other Animal Production", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "51637833-1132-4f7e-9936-d6172e9fefaf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c1e1d869-90a5-4386-bf91-c41bd17224ad", + "value": "11299" + }, + { + "description": "All Other Animal Production ", + "related": [ + { + "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c1e1d869-90a5-4386-bf91-c41bd17224ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "51637833-1132-4f7e-9936-d6172e9fefaf", + "value": "112990" + }, + { + "description": "Forestry and Logging", + "related": [ + { + "dest-uuid": "1030235b-86c8-4c20-b115-61aba9d6c4ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "66c1faeb-bf07-4a3f-ba8d-9d23849b674d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "186cebed-dbef-41a9-8927-b21cec10cd79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "780fc42e-f5e5-4651-842f-2b5ceb223495", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bbcb8b8b-655b-483e-ba16-a4d5f65fa9a6", + "value": "113" + }, + { + "description": "Timber Tract Operations", + "related": [ + { + "dest-uuid": "bbcb8b8b-655b-483e-ba16-a4d5f65fa9a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "54f342ce-3f36-4e95-8ab1-69516e83312e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cd9cfec9-51c9-4e50-ac1e-d2406fd8041f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "66c1faeb-bf07-4a3f-ba8d-9d23849b674d", + "value": "1131" + }, + { + "description": "Timber Tract Operations", + "related": [ + { + "dest-uuid": "66c1faeb-bf07-4a3f-ba8d-9d23849b674d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cd9cfec9-51c9-4e50-ac1e-d2406fd8041f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "54f342ce-3f36-4e95-8ab1-69516e83312e", + "value": "11311" + }, + { + "description": "Timber Tract Operations", + "related": [ + { + "dest-uuid": "66c1faeb-bf07-4a3f-ba8d-9d23849b674d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "54f342ce-3f36-4e95-8ab1-69516e83312e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cd9cfec9-51c9-4e50-ac1e-d2406fd8041f", + "value": "113110" + }, + { + "description": "Forest Nurseries and Gathering of Forest Products", + "related": [ + { + "dest-uuid": "bbcb8b8b-655b-483e-ba16-a4d5f65fa9a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fe8a0071-3360-496f-90c4-a5341b7a2020", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8b838710-3b05-40a8-a83b-c7e329d23311", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "186cebed-dbef-41a9-8927-b21cec10cd79", + "value": "1132" + }, + { + "description": "Forest Nurseries and Gathering of Forest Products", + "related": [ + { + "dest-uuid": "186cebed-dbef-41a9-8927-b21cec10cd79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8b838710-3b05-40a8-a83b-c7e329d23311", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fe8a0071-3360-496f-90c4-a5341b7a2020", + "value": "11321" + }, + { + "description": "Forest Nurseries and Gathering of Forest Products ", + "related": [ + { + "dest-uuid": "186cebed-dbef-41a9-8927-b21cec10cd79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fe8a0071-3360-496f-90c4-a5341b7a2020", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8b838710-3b05-40a8-a83b-c7e329d23311", + "value": "113210" + }, + { + "description": "Logging", + "related": [ + { + "dest-uuid": "bbcb8b8b-655b-483e-ba16-a4d5f65fa9a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f5c5afee-e695-4a48-b1f6-f2a723406199", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2e72d1ca-cca8-4405-9402-50dae153d5ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "780fc42e-f5e5-4651-842f-2b5ceb223495", + "value": "1133" + }, + { + "description": "Logging", + "related": [ + { + "dest-uuid": "780fc42e-f5e5-4651-842f-2b5ceb223495", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2e72d1ca-cca8-4405-9402-50dae153d5ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f5c5afee-e695-4a48-b1f6-f2a723406199", + "value": "11331" + }, + { + "description": "Logging ", + "related": [ + { + "dest-uuid": "780fc42e-f5e5-4651-842f-2b5ceb223495", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f5c5afee-e695-4a48-b1f6-f2a723406199", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2e72d1ca-cca8-4405-9402-50dae153d5ea", + "value": "113310" + }, + { + "description": "Fishing, Hunting and Trapping", + "related": [ + { + "dest-uuid": "1030235b-86c8-4c20-b115-61aba9d6c4ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "52332ff7-305c-4ef7-857e-46a46a4e76b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c1eeb2b8-84bf-488b-99c4-46519f4911c1", + "value": "114" + }, + { + "description": "Fishing", + "related": [ + { + "dest-uuid": "c1eeb2b8-84bf-488b-99c4-46519f4911c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "369c74bc-cfee-47c5-9f94-aa9766e59f41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "326b350d-2c88-4d8e-8c78-b10138f1f999", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "16c59474-57fb-4557-8da7-c4425160311f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "156365a6-37b6-4c91-9624-9a524a831889", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f211f4cb-77c1-425e-987f-838efee6786d", + "value": "1141" + }, + { + "description": "Fishing", + "related": [ + { + "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "369c74bc-cfee-47c5-9f94-aa9766e59f41", + "value": "11411" + }, + { + "description": "Finfish Fishing ", + "related": [ + { + "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "326b350d-2c88-4d8e-8c78-b10138f1f999", + "value": "114111" + }, + { + "description": "Shellfish Fishing ", + "related": [ + { + "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "16c59474-57fb-4557-8da7-c4425160311f", + "value": "114112" + }, + { + "description": "Other Marine Fishing ", + "related": [ + { + "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "156365a6-37b6-4c91-9624-9a524a831889", + "value": "114119" + }, + { + "description": "Hunting and Trapping", + "related": [ + { + "dest-uuid": "c1eeb2b8-84bf-488b-99c4-46519f4911c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "51020bd1-5982-49a1-81d4-96f031e9bfc2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "95564e2b-a515-48f1-9209-fef813db1764", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "52332ff7-305c-4ef7-857e-46a46a4e76b6", + "value": "1142" + }, + { + "description": "Hunting and Trapping", + "related": [ + { + "dest-uuid": "52332ff7-305c-4ef7-857e-46a46a4e76b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "95564e2b-a515-48f1-9209-fef813db1764", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "51020bd1-5982-49a1-81d4-96f031e9bfc2", + "value": "11421" + }, + { + "description": "Hunting and Trapping", + "related": [ + { + "dest-uuid": "52332ff7-305c-4ef7-857e-46a46a4e76b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "51020bd1-5982-49a1-81d4-96f031e9bfc2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "95564e2b-a515-48f1-9209-fef813db1764", + "value": "114210" + }, + { + "description": "Support Activities for Agriculture and Forestry", + "related": [ + { + "dest-uuid": "1030235b-86c8-4c20-b115-61aba9d6c4ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "00a9cbdd-59f8-43a5-908c-4ab4c9d5a23f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d5a86eb-3936-4bde-95c1-4f3e969944eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "602b67ae-a729-495c-8e67-e50b94d193f9", + "value": "115" + }, + { + "description": "Support Activities for Crop Production", + "related": [ + { + "dest-uuid": "602b67ae-a729-495c-8e67-e50b94d193f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "571c97ca-e6cd-463a-862c-b146ed3eda8b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8311db25-3bb3-44c4-926e-e640f601edc3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3f639245-6238-468d-9d0c-2244467b247d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "170e9ae3-32ae-412a-8b21-af3c388396b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0ed9eb78-f9a1-457a-b499-0cc65cbcb664", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d82971fa-afdf-4d77-b7d7-5711d9ef8b2e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bd6e9e12-4cad-4346-bff6-11768e0d02cd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "value": "1151" + }, + { + "description": "Support Activities for Crop Production", + "related": [ + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "571c97ca-e6cd-463a-862c-b146ed3eda8b", + "value": "11511" + }, + { + "description": "Cotton Ginning ", + "related": [ + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8311db25-3bb3-44c4-926e-e640f601edc3", + "value": "115111" + }, + { + "description": "Soil Preparation, Planting, and Cultivating ", + "related": [ + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3f639245-6238-468d-9d0c-2244467b247d", + "value": "115112" + }, + { + "description": "Crop Harvesting, Primarily by Machine ", + "related": [ + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "170e9ae3-32ae-412a-8b21-af3c388396b0", + "value": "115113" + }, + { + "description": "Postharvest Crop Activities (except Cotton Ginning) ", + "related": [ + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0ed9eb78-f9a1-457a-b499-0cc65cbcb664", + "value": "115114" + }, + { + "description": "Farm Labor Contractors and Crew Leaders ", + "related": [ + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d82971fa-afdf-4d77-b7d7-5711d9ef8b2e", + "value": "115115" + }, + { + "description": "Farm Management Services ", + "related": [ + { + "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bd6e9e12-4cad-4346-bff6-11768e0d02cd", + "value": "115116" + }, + { + "description": "Support Activities for Animal Production", + "related": [ + { + "dest-uuid": "602b67ae-a729-495c-8e67-e50b94d193f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6669ab41-08ab-43fb-84d5-49f041264839", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "be3954eb-6a69-41ad-87ae-c9bb5695b421", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "00a9cbdd-59f8-43a5-908c-4ab4c9d5a23f", + "value": "1152" + }, + { + "description": "Support Activities for Animal Production", + "related": [ + { + "dest-uuid": "00a9cbdd-59f8-43a5-908c-4ab4c9d5a23f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "be3954eb-6a69-41ad-87ae-c9bb5695b421", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6669ab41-08ab-43fb-84d5-49f041264839", + "value": "11521" + }, + { + "description": "Support Activities for Animal Production", + "related": [ + { + "dest-uuid": "00a9cbdd-59f8-43a5-908c-4ab4c9d5a23f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6669ab41-08ab-43fb-84d5-49f041264839", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "be3954eb-6a69-41ad-87ae-c9bb5695b421", + "value": "115210" + }, + { + "description": "Support Activities for Forestry", + "related": [ + { + "dest-uuid": "602b67ae-a729-495c-8e67-e50b94d193f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e49db108-0c74-4c92-8c82-a2bf3fe9e7d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c99dfc81-2bc8-4710-a17c-e3332f4a2169", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3d5a86eb-3936-4bde-95c1-4f3e969944eb", + "value": "1153" + }, + { + "description": "Support Activities for Forestry", + "related": [ + { + "dest-uuid": "3d5a86eb-3936-4bde-95c1-4f3e969944eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c99dfc81-2bc8-4710-a17c-e3332f4a2169", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e49db108-0c74-4c92-8c82-a2bf3fe9e7d1", + "value": "11531" + }, + { + "description": "Support Activities for Forestry", + "related": [ + { + "dest-uuid": "3d5a86eb-3936-4bde-95c1-4f3e969944eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e49db108-0c74-4c92-8c82-a2bf3fe9e7d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c99dfc81-2bc8-4710-a17c-e3332f4a2169", + "value": "115310" + }, + { + "description": "Mining, Quarrying, and Oil and Gas Extraction", + "related": [ + { + "dest-uuid": "54e4f685-7d73-4e09-a319-d75a193fc3dd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5014628e-42b4-477d-9f26-044adc3a1374", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5705acbe-ce86-4f32-a387-1b8ac35232ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bd4cf856-5df3-4330-b416-5bf538e4063b", + "value": "21" + }, + { + "description": "Oil and Gas Extraction", + "related": [ + { + "dest-uuid": "bd4cf856-5df3-4330-b416-5bf538e4063b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f35cac8f-c9f1-459d-80f2-22d772293fe7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "54e4f685-7d73-4e09-a319-d75a193fc3dd", + "value": "211" + }, + { + "description": "Oil and Gas Extraction", + "related": [ + { + "dest-uuid": "54e4f685-7d73-4e09-a319-d75a193fc3dd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b376523-bdf5-42ce-ad0c-4b50257ef59a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d66198ed-2f3a-4c93-baef-8508380dec37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "24c2ab59-7071-4223-ac9b-741255f24e2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5264a24c-0a80-40ec-9efd-f1d342ba7238", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f35cac8f-c9f1-459d-80f2-22d772293fe7", + "value": "2111" + }, + { + "description": "Crude Petroleum Extraction ", + "related": [ + { + "dest-uuid": "f35cac8f-c9f1-459d-80f2-22d772293fe7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d66198ed-2f3a-4c93-baef-8508380dec37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2b376523-bdf5-42ce-ad0c-4b50257ef59a", + "value": "21112" + }, + { + "description": "Crude Petroleum Extraction ", + "related": [ + { + "dest-uuid": "f35cac8f-c9f1-459d-80f2-22d772293fe7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b376523-bdf5-42ce-ad0c-4b50257ef59a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d66198ed-2f3a-4c93-baef-8508380dec37", + "value": "211120" + }, + { + "description": "Natural Gas Extraction ", + "related": [ + { + "dest-uuid": "f35cac8f-c9f1-459d-80f2-22d772293fe7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5264a24c-0a80-40ec-9efd-f1d342ba7238", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "24c2ab59-7071-4223-ac9b-741255f24e2a", + "value": "21113" + }, + { + "description": "Natural Gas Extraction ", + "related": [ + { + "dest-uuid": "f35cac8f-c9f1-459d-80f2-22d772293fe7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "24c2ab59-7071-4223-ac9b-741255f24e2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5264a24c-0a80-40ec-9efd-f1d342ba7238", + "value": "211130" + }, + { + "description": "Mining (except Oil and Gas)", + "related": [ + { + "dest-uuid": "bd4cf856-5df3-4330-b416-5bf538e4063b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c13b54a-f007-4b41-88e2-919f47ddc568", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5014628e-42b4-477d-9f26-044adc3a1374", + "value": "212" + }, + { + "description": "Coal Mining", + "related": [ + { + "dest-uuid": "5014628e-42b4-477d-9f26-044adc3a1374", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2272d8c1-a353-4b00-9aa6-dfb25c1447f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "960fbaa7-e5e9-4de4-bfa3-8c99dd6e0714", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4107b7b7-e38d-4070-a891-84a8b4999841", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8c13b54a-f007-4b41-88e2-919f47ddc568", + "value": "2121" + }, + { + "description": "Coal Mining", + "related": [ + { + "dest-uuid": "8c13b54a-f007-4b41-88e2-919f47ddc568", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2272d8c1-a353-4b00-9aa6-dfb25c1447f0", + "value": "21211" + }, + { + "description": "Surface Coal Mining ", + "related": [ + { + "dest-uuid": "8c13b54a-f007-4b41-88e2-919f47ddc568", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "960fbaa7-e5e9-4de4-bfa3-8c99dd6e0714", + "value": "212114" + }, + { + "description": "Underground Coal Mining ", + "related": [ + { + "dest-uuid": "8c13b54a-f007-4b41-88e2-919f47ddc568", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4107b7b7-e38d-4070-a891-84a8b4999841", + "value": "212115" + }, + { + "description": "Metal Ore Mining", + "related": [ + { + "dest-uuid": "5014628e-42b4-477d-9f26-044adc3a1374", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "65460dcd-9e36-4a3e-b9f6-a6c7100048b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5a637313-961f-4b18-a810-7886b9aa3643", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2eeb3fe7-ca97-4a9b-88d8-c74d6765e453", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "42a7a52e-1090-4199-91df-a81e71555636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "437d09e3-e0f6-49fa-9acf-cc83422d5913", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0879484b-19cb-4d14-989b-3d0135be200b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9d9d21f8-0cbf-4cea-b2f1-0aafc0c69fd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5b1d7572-e04f-4fa7-ba3a-96a7625ee1d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "value": "2122" + }, + { + "description": "Iron Ore Mining", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5a637313-961f-4b18-a810-7886b9aa3643", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "65460dcd-9e36-4a3e-b9f6-a6c7100048b4", + "value": "21221" + }, + { + "description": "Iron Ore Mining", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "65460dcd-9e36-4a3e-b9f6-a6c7100048b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5a637313-961f-4b18-a810-7886b9aa3643", + "value": "212210" + }, + { + "description": "Gold Ore and Silver Ore Mining", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "42a7a52e-1090-4199-91df-a81e71555636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2eeb3fe7-ca97-4a9b-88d8-c74d6765e453", + "value": "21222" + }, + { + "description": "Gold Ore and Silver Ore Mining ", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2eeb3fe7-ca97-4a9b-88d8-c74d6765e453", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "42a7a52e-1090-4199-91df-a81e71555636", + "value": "212220" + }, + { + "description": "Copper, Nickel, Lead, and Zinc Mining", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0879484b-19cb-4d14-989b-3d0135be200b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "437d09e3-e0f6-49fa-9acf-cc83422d5913", + "value": "21223" + }, + { + "description": "Copper, Nickel, Lead, and Zinc Mining ", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "437d09e3-e0f6-49fa-9acf-cc83422d5913", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0879484b-19cb-4d14-989b-3d0135be200b", + "value": "212230" + }, + { + "description": "Other Metal Ore Mining", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5b1d7572-e04f-4fa7-ba3a-96a7625ee1d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9d9d21f8-0cbf-4cea-b2f1-0aafc0c69fd4", + "value": "21229" + }, + { + "description": "Other Metal Ore Mining ", + "related": [ + { + "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9d9d21f8-0cbf-4cea-b2f1-0aafc0c69fd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5b1d7572-e04f-4fa7-ba3a-96a7625ee1d1", + "value": "212290" + }, + { + "description": "Nonmetallic Mineral Mining and Quarrying", + "related": [ + { + "dest-uuid": "5014628e-42b4-477d-9f26-044adc3a1374", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6bcc31b0-37c8-4584-88f9-5a2b85fa7669", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1a5f91e7-3dbf-4357-b1a2-df381718eb4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "33add328-97f3-49c9-b4ea-8398bbe0bbdd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "10db3d21-739b-4935-8306-fc61e0972855", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6a4dabe3-60aa-4863-bd6d-daf07e857e6e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d6988e6e-54a1-491f-aef2-8c46f914bb44", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "533684f4-7b68-4f46-8b7f-72cdafc45dce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "683802de-31d0-4699-9005-f020fc249ff2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "14958ddf-359b-48d7-a876-a46c6e9ab5e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b2753909-f7b2-4bb0-89b5-113e4247956d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ace4e7ab-3da9-4f63-b7a2-19f7046b3428", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "value": "2123" + }, + { + "description": "Stone Mining and Quarrying", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6bcc31b0-37c8-4584-88f9-5a2b85fa7669", + "value": "21231" + }, + { + "description": "Dimension Stone Mining and Quarrying ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1a5f91e7-3dbf-4357-b1a2-df381718eb4a", + "value": "212311" + }, + { + "description": "Crushed and Broken Limestone Mining and Quarrying ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "33add328-97f3-49c9-b4ea-8398bbe0bbdd", + "value": "212312" + }, + { + "description": "Crushed and Broken Granite Mining and Quarrying ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "10db3d21-739b-4935-8306-fc61e0972855", + "value": "212313" + }, + { + "description": "Other Crushed and Broken Stone Mining and Quarrying ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6a4dabe3-60aa-4863-bd6d-daf07e857e6e", + "value": "212319" + }, + { + "description": "Sand, Gravel, Clay, and Ceramic and Refractory Minerals Mining and Quarrying", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d6988e6e-54a1-491f-aef2-8c46f914bb44", + "value": "21232" + }, + { + "description": "Construction Sand and Gravel Mining ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "533684f4-7b68-4f46-8b7f-72cdafc45dce", + "value": "212321" + }, + { + "description": "Industrial Sand Mining ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "683802de-31d0-4699-9005-f020fc249ff2", + "value": "212322" + }, + { + "description": "Kaolin, Clay, and Ceramic and Refractory Minerals Mining ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "14958ddf-359b-48d7-a876-a46c6e9ab5e5", + "value": "212323" + }, + { + "description": "Other Nonmetallic Mineral Mining and Quarrying", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ace4e7ab-3da9-4f63-b7a2-19f7046b3428", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b2753909-f7b2-4bb0-89b5-113e4247956d", + "value": "21239" + }, + { + "description": "Other Nonmetallic Mineral Mining and Quarrying ", + "related": [ + { + "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b2753909-f7b2-4bb0-89b5-113e4247956d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ace4e7ab-3da9-4f63-b7a2-19f7046b3428", + "value": "212390" + }, + { + "description": "Support Activities for Mining", + "related": [ + { + "dest-uuid": "bd4cf856-5df3-4330-b416-5bf538e4063b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5705acbe-ce86-4f32-a387-1b8ac35232ba", + "value": "213" + }, + { + "description": "Support Activities for Mining", + "related": [ + { + "dest-uuid": "5705acbe-ce86-4f32-a387-1b8ac35232ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e4d70857-807e-4e07-b4a9-45b8642f1e66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "07fb4895-d796-4fa2-865a-3e18e9a1634a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d397292-5e7d-4967-a6a4-1896ff5f2b8c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "946556c5-e1fc-4894-b7b6-6114b934eb2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0e9c91c0-16aa-4c5c-9ad5-4953a131f20f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7f53cd31-b987-460f-9330-81f11c73cd6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "value": "2131" + }, + { + "description": "Support Activities for Mining", + "related": [ + { + "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e4d70857-807e-4e07-b4a9-45b8642f1e66", + "value": "21311" + }, + { + "description": "Drilling Oil and Gas Wells", + "related": [ + { + "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "07fb4895-d796-4fa2-865a-3e18e9a1634a", + "value": "213111" + }, + { + "description": "Support Activities for Oil and Gas Operations ", + "related": [ + { + "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3d397292-5e7d-4967-a6a4-1896ff5f2b8c", + "value": "213112" + }, + { + "description": "Support Activities for Coal Mining ", + "related": [ + { + "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "946556c5-e1fc-4894-b7b6-6114b934eb2b", + "value": "213113" + }, + { + "description": "Support Activities for Metal Mining ", + "related": [ + { + "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0e9c91c0-16aa-4c5c-9ad5-4953a131f20f", + "value": "213114" + }, + { + "description": "Support Activities for Nonmetallic Minerals (except Fuels) Mining ", + "related": [ + { + "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7f53cd31-b987-460f-9330-81f11c73cd6b", + "value": "213115" + }, + { + "description": "Utilities", + "related": [ + { + "dest-uuid": "0868bbea-64a4-4987-a5d1-15180a13d244", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "97fc4eee-ed1f-477c-99d5-9530c8e3b13b", + "value": "22" + }, + { + "description": "Utilities ", + "related": [ + { + "dest-uuid": "97fc4eee-ed1f-477c-99d5-9530c8e3b13b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "80a283aa-4ef6-4b37-bf0d-1886617395c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0868bbea-64a4-4987-a5d1-15180a13d244", + "value": "221" + }, + { + "description": "Electric Power Generation, Transmission and Distribution", + "related": [ + { + "dest-uuid": "0868bbea-64a4-4987-a5d1-15180a13d244", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eafc5c5c-f167-470d-bc74-1db9444a0600", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a4f2b56a-19bd-4ef7-b5d8-3c100401ec4d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a796d8e2-51fd-4d33-ae7a-580efc6c3c88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f99207be-e801-4c38-b272-ee77685f351b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "99e6c3d4-e3dc-47ca-8c90-37fa1a5918c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "234bd9c7-af59-45a4-ab5a-3c09caacc952", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "34b97ae0-4d17-4705-b3f1-c63ae0b1394f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "225eef2a-92f0-4648-b2bb-23b7f8949770", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "547509ac-ca15-4771-9e83-de9560c877c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "935c5003-ae2a-4c5e-8066-194c252f63c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b7de90e1-2695-4052-bc34-7b9737fd2434", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e5e2f3cd-366b-4d06-adcf-ba8981491552", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "value": "2211" + }, + { + "description": "Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "eafc5c5c-f167-470d-bc74-1db9444a0600", + "value": "22111" + }, + { + "description": "Hydroelectric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a4f2b56a-19bd-4ef7-b5d8-3c100401ec4d", + "value": "221111" + }, + { + "description": "Fossil Fuel Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a796d8e2-51fd-4d33-ae7a-580efc6c3c88", + "value": "221112" + }, + { + "description": "Nuclear Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f99207be-e801-4c38-b272-ee77685f351b", + "value": "221113" + }, + { + "description": "Solar Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "99e6c3d4-e3dc-47ca-8c90-37fa1a5918c2", + "value": "221114" + }, + { + "description": "Wind Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "234bd9c7-af59-45a4-ab5a-3c09caacc952", + "value": "221115" + }, + { + "description": "Geothermal Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "34b97ae0-4d17-4705-b3f1-c63ae0b1394f", + "value": "221116" + }, + { + "description": "Biomass Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "225eef2a-92f0-4648-b2bb-23b7f8949770", + "value": "221117" + }, + { + "description": "Other Electric Power Generation ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "547509ac-ca15-4771-9e83-de9560c877c2", + "value": "221118" + }, + { + "description": "Electric Power Transmission, Control, and Distribution ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "935c5003-ae2a-4c5e-8066-194c252f63c1", + "value": "22112" + }, + { + "description": "Electric Bulk Power Transmission and Control ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b7de90e1-2695-4052-bc34-7b9737fd2434", + "value": "221121" + }, + { + "description": "Electric Power Distribution ", + "related": [ + { + "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e5e2f3cd-366b-4d06-adcf-ba8981491552", + "value": "221122" + }, + { + "description": "Natural Gas Distribution ", + "related": [ + { + "dest-uuid": "0868bbea-64a4-4987-a5d1-15180a13d244", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "23c72aa2-5390-4b89-95e7-8bb4e764a9cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "95355345-433f-4ef9-b753-639e8973311a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "80a283aa-4ef6-4b37-bf0d-1886617395c2", + "value": "2212" + }, + { + "description": "Natural Gas Distribution ", + "related": [ + { + "dest-uuid": "80a283aa-4ef6-4b37-bf0d-1886617395c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "95355345-433f-4ef9-b753-639e8973311a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "23c72aa2-5390-4b89-95e7-8bb4e764a9cc", + "value": "22121" + }, + { + "description": "Natural Gas Distribution ", + "related": [ + { + "dest-uuid": "80a283aa-4ef6-4b37-bf0d-1886617395c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "23c72aa2-5390-4b89-95e7-8bb4e764a9cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "95355345-433f-4ef9-b753-639e8973311a", + "value": "221210" + }, + { + "description": "Water, Sewage and Other Systems ", + "related": [ + { + "dest-uuid": "0868bbea-64a4-4987-a5d1-15180a13d244", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "61e663d8-069e-423a-9870-ca4b48205dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "15af112e-8f7c-4e25-adc9-4167553faed3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7ecde07e-ce98-42b8-9515-dfc7398dba7d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1088b850-16eb-4a2a-a8a3-7af31188daef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "163735fa-2c0c-47ec-a483-16d4673a70a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c6ffed8-b9c8-4c39-ade9-29b728eb2cfc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "value": "2213" + }, + { + "description": "Water Supply and Irrigation Systems ", + "related": [ + { + "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "15af112e-8f7c-4e25-adc9-4167553faed3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "61e663d8-069e-423a-9870-ca4b48205dd1", + "value": "22131" + }, + { + "description": "Water Supply and Irrigation Systems ", + "related": [ + { + "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "61e663d8-069e-423a-9870-ca4b48205dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "15af112e-8f7c-4e25-adc9-4167553faed3", + "value": "221310" + }, + { + "description": "Sewage Treatment Facilities ", + "related": [ + { + "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1088b850-16eb-4a2a-a8a3-7af31188daef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7ecde07e-ce98-42b8-9515-dfc7398dba7d", + "value": "22132" + }, + { + "description": "Sewage Treatment Facilities ", + "related": [ + { + "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7ecde07e-ce98-42b8-9515-dfc7398dba7d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1088b850-16eb-4a2a-a8a3-7af31188daef", + "value": "221320" + }, + { + "description": "Steam and Air-Conditioning Supply ", + "related": [ + { + "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c6ffed8-b9c8-4c39-ade9-29b728eb2cfc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "163735fa-2c0c-47ec-a483-16d4673a70a1", + "value": "22133" + }, + { + "description": "Steam and Air-Conditioning Supply ", + "related": [ + { + "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "163735fa-2c0c-47ec-a483-16d4673a70a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c6ffed8-b9c8-4c39-ade9-29b728eb2cfc", + "value": "221330" + }, + { + "description": "Construction", + "related": [ + { + "dest-uuid": "e407d944-3f26-4104-8449-cf01c296868b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5c12a904-dd69-48e2-ac40-98ccfe5b5988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e892cf77-c1db-466e-9be3-85624515a826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9a17c9d0-05e0-49a0-ae70-b59c443d294a", + "value": "23" + }, + { + "description": "Construction of Buildings", + "related": [ + { + "dest-uuid": "9a17c9d0-05e0-49a0-ae70-b59c443d294a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6b107009-5116-432f-8dfe-e66a91e01561", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e407d944-3f26-4104-8449-cf01c296868b", + "value": "236" + }, + { + "description": "Residential Building Construction", + "related": [ + { + "dest-uuid": "e407d944-3f26-4104-8449-cf01c296868b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2a4f46a3-12ab-40a0-937f-927bfa56aadc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3e287136-ca86-42d4-80fb-4f75505f9c2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "92e35dbe-7b13-44c3-bb8c-895fd6efd79d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "37be48ff-c461-4db3-a5e6-6219a07c1274", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "18c39fb9-5790-448b-8d18-7f6cbd83ea05", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", + "value": "2361" + }, + { + "description": "Residential Building Construction", + "related": [ + { + "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2a4f46a3-12ab-40a0-937f-927bfa56aadc", + "value": "23611" + }, + { + "description": "New Single-Family Housing Construction (except For-Sale Builders) ", + "related": [ + { + "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3e287136-ca86-42d4-80fb-4f75505f9c2a", + "value": "236115" + }, + { + "description": "New Multifamily Housing Construction (except For-Sale Builders) ", + "related": [ + { + "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "92e35dbe-7b13-44c3-bb8c-895fd6efd79d", + "value": "236116" + }, + { + "description": "New Housing For-Sale Builders ", + "related": [ + { + "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "37be48ff-c461-4db3-a5e6-6219a07c1274", + "value": "236117" + }, + { + "description": "Residential Remodelers ", + "related": [ + { + "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "18c39fb9-5790-448b-8d18-7f6cbd83ea05", + "value": "236118" + }, + { + "description": "Nonresidential Building Construction", + "related": [ + { + "dest-uuid": "e407d944-3f26-4104-8449-cf01c296868b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "00cc1316-b2dd-4fff-9cc0-52a1f70b4085", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b2acadc1-09b9-4f8a-a455-ad5f1945e2de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "84108ace-bde5-4c75-b193-7ed201800f2c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bc36a8a9-7d82-4857-9212-1357eb83814c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6b107009-5116-432f-8dfe-e66a91e01561", + "value": "2362" + }, + { + "description": "Industrial Building Construction", + "related": [ + { + "dest-uuid": "6b107009-5116-432f-8dfe-e66a91e01561", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b2acadc1-09b9-4f8a-a455-ad5f1945e2de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "00cc1316-b2dd-4fff-9cc0-52a1f70b4085", + "value": "23621" + }, + { + "description": "Industrial Building Construction ", + "related": [ + { + "dest-uuid": "6b107009-5116-432f-8dfe-e66a91e01561", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "00cc1316-b2dd-4fff-9cc0-52a1f70b4085", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b2acadc1-09b9-4f8a-a455-ad5f1945e2de", + "value": "236210" + }, + { + "description": "Commercial and Institutional Building Construction", + "related": [ + { + "dest-uuid": "6b107009-5116-432f-8dfe-e66a91e01561", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bc36a8a9-7d82-4857-9212-1357eb83814c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "84108ace-bde5-4c75-b193-7ed201800f2c", + "value": "23622" + }, + { + "description": "Commercial and Institutional Building Construction ", + "related": [ + { + "dest-uuid": "6b107009-5116-432f-8dfe-e66a91e01561", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "84108ace-bde5-4c75-b193-7ed201800f2c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bc36a8a9-7d82-4857-9212-1357eb83814c", + "value": "236220" + }, + { + "description": "Heavy and Civil Engineering Construction", + "related": [ + { + "dest-uuid": "9a17c9d0-05e0-49a0-ae70-b59c443d294a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "73e76411-4e62-4b90-a497-e8b1238634a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d9844d6-27a1-4013-8843-dcbd7a4c1e77", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0654d572-15b3-4324-ac52-b58be4a3d1c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5c12a904-dd69-48e2-ac40-98ccfe5b5988", + "value": "237" + }, + { + "description": "Utility System Construction", + "related": [ + { + "dest-uuid": "5c12a904-dd69-48e2-ac40-98ccfe5b5988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f106a2d2-2ede-4e8b-894a-64aa6a79cfff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "90c96bf3-ac91-46b7-b12e-a4ed6ce5efb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b0e48b52-0ebe-47c1-80b2-e047ef6b5f85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2281a409-5d54-472c-aa94-454626a59c47", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "64604934-8827-4550-9d6f-41c5a9f7471f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e25dcebc-0553-4a5e-a291-10f25cd8c577", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "value": "2371" + }, + { + "description": "Water and Sewer Line and Related Structures Construction", + "related": [ + { + "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90c96bf3-ac91-46b7-b12e-a4ed6ce5efb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f106a2d2-2ede-4e8b-894a-64aa6a79cfff", + "value": "23711" + }, + { + "description": "Water and Sewer Line and Related Structures Construction ", + "related": [ + { + "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f106a2d2-2ede-4e8b-894a-64aa6a79cfff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "90c96bf3-ac91-46b7-b12e-a4ed6ce5efb8", + "value": "237110" + }, + { + "description": "Oil and Gas Pipeline and Related Structures Construction", + "related": [ + { + "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2281a409-5d54-472c-aa94-454626a59c47", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b0e48b52-0ebe-47c1-80b2-e047ef6b5f85", + "value": "23712" + }, + { + "description": "Oil and Gas Pipeline and Related Structures Construction ", + "related": [ + { + "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b0e48b52-0ebe-47c1-80b2-e047ef6b5f85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2281a409-5d54-472c-aa94-454626a59c47", + "value": "237120" + }, + { + "description": "Power and Communication Line and Related Structures Construction", + "related": [ + { + "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e25dcebc-0553-4a5e-a291-10f25cd8c577", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "64604934-8827-4550-9d6f-41c5a9f7471f", + "value": "23713" + }, + { + "description": "Power and Communication Line and Related Structures Construction ", + "related": [ + { + "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "64604934-8827-4550-9d6f-41c5a9f7471f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e25dcebc-0553-4a5e-a291-10f25cd8c577", + "value": "237130" + }, + { + "description": "Land Subdivision", + "related": [ + { + "dest-uuid": "5c12a904-dd69-48e2-ac40-98ccfe5b5988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bb91be59-b9d1-48ad-8037-591562710407", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1803d0b-8c31-45b1-a65f-2a9c86ef5c85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "73e76411-4e62-4b90-a497-e8b1238634a0", + "value": "2372" + }, + { + "description": "Land Subdivision", + "related": [ + { + "dest-uuid": "73e76411-4e62-4b90-a497-e8b1238634a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c1803d0b-8c31-45b1-a65f-2a9c86ef5c85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bb91be59-b9d1-48ad-8037-591562710407", + "value": "23721" + }, + { + "description": "Land Subdivision ", + "related": [ + { + "dest-uuid": "73e76411-4e62-4b90-a497-e8b1238634a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bb91be59-b9d1-48ad-8037-591562710407", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c1803d0b-8c31-45b1-a65f-2a9c86ef5c85", + "value": "237210" + }, + { + "description": "Highway, Street, and Bridge Construction", + "related": [ + { + "dest-uuid": "5c12a904-dd69-48e2-ac40-98ccfe5b5988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "58c40aca-df0c-4f7f-aabc-1a20d208ec69", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f223e554-0b7d-473e-b87b-aa954939763f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7d9844d6-27a1-4013-8843-dcbd7a4c1e77", + "value": "2373" + }, + { + "description": "Highway, Street, and Bridge Construction", + "related": [ + { + "dest-uuid": "7d9844d6-27a1-4013-8843-dcbd7a4c1e77", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f223e554-0b7d-473e-b87b-aa954939763f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "58c40aca-df0c-4f7f-aabc-1a20d208ec69", + "value": "23731" + }, + { + "description": "Highway, Street, and Bridge Construction ", + "related": [ + { + "dest-uuid": "7d9844d6-27a1-4013-8843-dcbd7a4c1e77", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "58c40aca-df0c-4f7f-aabc-1a20d208ec69", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f223e554-0b7d-473e-b87b-aa954939763f", + "value": "237310" + }, + { + "description": "Other Heavy and Civil Engineering Construction", + "related": [ + { + "dest-uuid": "5c12a904-dd69-48e2-ac40-98ccfe5b5988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3511f73b-0b90-4c5f-b82c-f69d3852328c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0ea91e0d-2fb7-49d1-88fc-ab595d8aa065", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0654d572-15b3-4324-ac52-b58be4a3d1c7", + "value": "2379" + }, + { + "description": "Other Heavy and Civil Engineering Construction", + "related": [ + { + "dest-uuid": "0654d572-15b3-4324-ac52-b58be4a3d1c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0ea91e0d-2fb7-49d1-88fc-ab595d8aa065", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3511f73b-0b90-4c5f-b82c-f69d3852328c", + "value": "23799" + }, + { + "description": "Other Heavy and Civil Engineering Construction ", + "related": [ + { + "dest-uuid": "0654d572-15b3-4324-ac52-b58be4a3d1c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3511f73b-0b90-4c5f-b82c-f69d3852328c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0ea91e0d-2fb7-49d1-88fc-ab595d8aa065", + "value": "237990" + }, + { + "description": "Specialty Trade Contractors", + "related": [ + { + "dest-uuid": "9a17c9d0-05e0-49a0-ae70-b59c443d294a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c41fe7f6-e061-486d-9405-76cd63b51ec0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e892cf77-c1db-466e-9be3-85624515a826", + "value": "238" + }, + { + "description": "Foundation, Structure, and Building Exterior Contractors", + "related": [ + { + "dest-uuid": "e892cf77-c1db-466e-9be3-85624515a826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9f7cbded-9711-4cb6-93e6-91688119e33f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5cc853ea-f406-4ff2-b959-933a63e6f875", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "09b2bb4f-24c0-40c2-a388-159777d356bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "49f36b93-9cc8-4689-a257-8d54515b8c41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "de59fca7-c7f3-4e8c-bba5-a943a26d93c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "63bcf89d-0009-4f8f-94d6-ffe5a3103a5c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "59ba90c2-1b81-4c4c-9fea-84b4f09c7e4b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7c4d4375-e728-4927-bb88-f0a892668689", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "728ab664-9f8c-4418-b34e-8a70ff9f3375", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1454d89f-6603-4848-8ffd-0dd985859810", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c359a361-2907-4469-b9e9-857d3d983ffe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "116272a0-bd69-41b2-a2dc-89b14b74be91", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4c9ca62b-e016-420d-bbfd-ae5e8ee406ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fdd4952b-2aee-40a5-a9f4-58bf7fe5ba30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b042ce7a-2f74-4c65-bff9-fb7f458670d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cbae9909-f58e-43a5-b009-3a110616a93d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "value": "2381" + }, + { + "description": "Poured Concrete Foundation and Structure Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5cc853ea-f406-4ff2-b959-933a63e6f875", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9f7cbded-9711-4cb6-93e6-91688119e33f", + "value": "23811" + }, + { + "description": "Poured Concrete Foundation and Structure Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9f7cbded-9711-4cb6-93e6-91688119e33f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5cc853ea-f406-4ff2-b959-933a63e6f875", + "value": "238110" + }, + { + "description": "Structural Steel and Precast Concrete Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "49f36b93-9cc8-4689-a257-8d54515b8c41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "09b2bb4f-24c0-40c2-a388-159777d356bb", + "value": "23812" + }, + { + "description": "Structural Steel and Precast Concrete Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "09b2bb4f-24c0-40c2-a388-159777d356bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "49f36b93-9cc8-4689-a257-8d54515b8c41", + "value": "238120" + }, + { + "description": "Framing Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "63bcf89d-0009-4f8f-94d6-ffe5a3103a5c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "de59fca7-c7f3-4e8c-bba5-a943a26d93c6", + "value": "23813" + }, + { + "description": "Framing Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "de59fca7-c7f3-4e8c-bba5-a943a26d93c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "63bcf89d-0009-4f8f-94d6-ffe5a3103a5c", + "value": "238130" + }, + { + "description": "Masonry Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7c4d4375-e728-4927-bb88-f0a892668689", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "59ba90c2-1b81-4c4c-9fea-84b4f09c7e4b", + "value": "23814" + }, + { + "description": "Masonry Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "59ba90c2-1b81-4c4c-9fea-84b4f09c7e4b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7c4d4375-e728-4927-bb88-f0a892668689", + "value": "238140" + }, + { + "description": "Glass and Glazing Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1454d89f-6603-4848-8ffd-0dd985859810", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "728ab664-9f8c-4418-b34e-8a70ff9f3375", + "value": "23815" + }, + { + "description": "Glass and Glazing Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "728ab664-9f8c-4418-b34e-8a70ff9f3375", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1454d89f-6603-4848-8ffd-0dd985859810", + "value": "238150" + }, + { + "description": "Roofing Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "116272a0-bd69-41b2-a2dc-89b14b74be91", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c359a361-2907-4469-b9e9-857d3d983ffe", + "value": "23816" + }, + { + "description": "Roofing Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c359a361-2907-4469-b9e9-857d3d983ffe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "116272a0-bd69-41b2-a2dc-89b14b74be91", + "value": "238160" + }, + { + "description": "Siding Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fdd4952b-2aee-40a5-a9f4-58bf7fe5ba30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4c9ca62b-e016-420d-bbfd-ae5e8ee406ad", + "value": "23817" + }, + { + "description": "Siding Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4c9ca62b-e016-420d-bbfd-ae5e8ee406ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fdd4952b-2aee-40a5-a9f4-58bf7fe5ba30", + "value": "238170" + }, + { + "description": "Other Foundation, Structure, and Building Exterior Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cbae9909-f58e-43a5-b009-3a110616a93d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b042ce7a-2f74-4c65-bff9-fb7f458670d4", + "value": "23819" + }, + { + "description": "Other Foundation, Structure, and Building Exterior Contractors ", + "related": [ + { + "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b042ce7a-2f74-4c65-bff9-fb7f458670d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cbae9909-f58e-43a5-b009-3a110616a93d", + "value": "238190" + }, + { + "description": "Building Equipment Contractors", + "related": [ + { + "dest-uuid": "e892cf77-c1db-466e-9be3-85624515a826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "244dce43-cb7d-46f5-8d49-03c2c8ade1f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c9926700-05e2-48c7-9626-dbadcf72ce12", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2e0acff3-fe00-4824-9386-c3f43c050bbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0607564c-a129-4c13-8165-3a2715003dad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e82687d9-db34-49e3-9512-02d6681c3ef0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ad087d0d-d656-4a04-b255-1053ba0cd6ee", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "value": "2382" + }, + { + "description": "Electrical Contractors and Other Wiring Installation Contractors", + "related": [ + { + "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c9926700-05e2-48c7-9626-dbadcf72ce12", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "244dce43-cb7d-46f5-8d49-03c2c8ade1f7", + "value": "23821" + }, + { + "description": "Electrical Contractors and Other Wiring Installation Contractors", + "related": [ + { + "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "244dce43-cb7d-46f5-8d49-03c2c8ade1f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c9926700-05e2-48c7-9626-dbadcf72ce12", + "value": "238210" + }, + { + "description": "Plumbing, Heating, and Air-Conditioning Contractors", + "related": [ + { + "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0607564c-a129-4c13-8165-3a2715003dad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2e0acff3-fe00-4824-9386-c3f43c050bbb", + "value": "23822" + }, + { + "description": "Plumbing, Heating, and Air-Conditioning Contractors ", + "related": [ + { + "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2e0acff3-fe00-4824-9386-c3f43c050bbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0607564c-a129-4c13-8165-3a2715003dad", + "value": "238220" + }, + { + "description": "Other Building Equipment Contractors", + "related": [ + { + "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ad087d0d-d656-4a04-b255-1053ba0cd6ee", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e82687d9-db34-49e3-9512-02d6681c3ef0", + "value": "23829" + }, + { + "description": "Other Building Equipment Contractors ", + "related": [ + { + "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e82687d9-db34-49e3-9512-02d6681c3ef0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ad087d0d-d656-4a04-b255-1053ba0cd6ee", + "value": "238290" + }, + { + "description": "Building Finishing Contractors", + "related": [ + { + "dest-uuid": "e892cf77-c1db-466e-9be3-85624515a826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9cd02fa5-c145-47e7-a8f3-304cbb9df996", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a8aa12e6-95e3-4cbf-810b-f5e43266571b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eb75283c-d5fa-4ee4-aaa9-459f1c6ea33c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "49e8e9f0-84e0-4df2-b432-b666a35729bd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ec5eae5b-e61b-4a2a-956c-928d60b3a823", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f204fc88-0176-477d-9056-7b8426968888", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce499d14-ef4b-4a9e-a5df-d1d7c0e74d29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "df716aea-1f6a-4386-b502-dce8b6f2e10b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a41de114-f673-4b2b-8637-ae059bbf862d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5425bf84-6db5-44b9-8848-fbc485f11fc0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ab1e901f-ba47-46e9-bb34-0d636f80f000", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e76c6afa-1142-4ce1-b51d-6539ab05b2ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "value": "2383" + }, + { + "description": "Drywall and Insulation Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a8aa12e6-95e3-4cbf-810b-f5e43266571b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9cd02fa5-c145-47e7-a8f3-304cbb9df996", + "value": "23831" + }, + { + "description": "Drywall and Insulation Contractors ", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9cd02fa5-c145-47e7-a8f3-304cbb9df996", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a8aa12e6-95e3-4cbf-810b-f5e43266571b", + "value": "238310" + }, + { + "description": "Painting and Wall Covering Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "49e8e9f0-84e0-4df2-b432-b666a35729bd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eb75283c-d5fa-4ee4-aaa9-459f1c6ea33c", + "value": "23832" + }, + { + "description": "Painting and Wall Covering Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eb75283c-d5fa-4ee4-aaa9-459f1c6ea33c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "49e8e9f0-84e0-4df2-b432-b666a35729bd", + "value": "238320" + }, + { + "description": "Flooring Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f204fc88-0176-477d-9056-7b8426968888", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ec5eae5b-e61b-4a2a-956c-928d60b3a823", + "value": "23833" + }, + { + "description": "Flooring Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ec5eae5b-e61b-4a2a-956c-928d60b3a823", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f204fc88-0176-477d-9056-7b8426968888", + "value": "238330" + }, + { + "description": "Tile and Terrazzo Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "df716aea-1f6a-4386-b502-dce8b6f2e10b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ce499d14-ef4b-4a9e-a5df-d1d7c0e74d29", + "value": "23834" + }, + { + "description": "Tile and Terrazzo Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ce499d14-ef4b-4a9e-a5df-d1d7c0e74d29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "df716aea-1f6a-4386-b502-dce8b6f2e10b", + "value": "238340" + }, + { + "description": "Finish Carpentry Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5425bf84-6db5-44b9-8848-fbc485f11fc0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a41de114-f673-4b2b-8637-ae059bbf862d", + "value": "23835" + }, + { + "description": "Finish Carpentry Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a41de114-f673-4b2b-8637-ae059bbf862d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5425bf84-6db5-44b9-8848-fbc485f11fc0", + "value": "238350" + }, + { + "description": "Other Building Finishing Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e76c6afa-1142-4ce1-b51d-6539ab05b2ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ab1e901f-ba47-46e9-bb34-0d636f80f000", + "value": "23839" + }, + { + "description": "Other Building Finishing Contractors", + "related": [ + { + "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ab1e901f-ba47-46e9-bb34-0d636f80f000", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e76c6afa-1142-4ce1-b51d-6539ab05b2ec", + "value": "238390" + }, + { + "description": "Other Specialty Trade Contractors", + "related": [ + { + "dest-uuid": "e892cf77-c1db-466e-9be3-85624515a826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c02e88a0-c684-4d0b-abe4-87e096d39ec3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "178f83b6-50e2-4309-a1c4-7489c6660a96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5bffa9bd-53ea-489d-bc7b-91036dd22a2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "075056b1-b774-4251-b87f-4781767a7553", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c41fe7f6-e061-486d-9405-76cd63b51ec0", + "value": "2389" + }, + { + "description": "Site Preparation Contractors", + "related": [ + { + "dest-uuid": "c41fe7f6-e061-486d-9405-76cd63b51ec0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "178f83b6-50e2-4309-a1c4-7489c6660a96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c02e88a0-c684-4d0b-abe4-87e096d39ec3", + "value": "23891" + }, + { + "description": "Site Preparation Contractors", + "related": [ + { + "dest-uuid": "c41fe7f6-e061-486d-9405-76cd63b51ec0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c02e88a0-c684-4d0b-abe4-87e096d39ec3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "178f83b6-50e2-4309-a1c4-7489c6660a96", + "value": "238910" + }, + { + "description": "All Other Specialty Trade Contractors", + "related": [ + { + "dest-uuid": "c41fe7f6-e061-486d-9405-76cd63b51ec0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "075056b1-b774-4251-b87f-4781767a7553", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5bffa9bd-53ea-489d-bc7b-91036dd22a2d", + "value": "23899" + }, + { + "description": "All Other Specialty Trade Contractors", + "related": [ + { + "dest-uuid": "c41fe7f6-e061-486d-9405-76cd63b51ec0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5bffa9bd-53ea-489d-bc7b-91036dd22a2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "075056b1-b774-4251-b87f-4781767a7553", + "value": "238990" + }, + { + "description": "Manufacturing", + "related": [], + "uuid": "b1591ecc-e9c8-4606-b081-3763f5ba8e64", + "value": "31-33" + }, + { + "description": "Food Manufacturing", + "related": [ + { + "dest-uuid": "f8194f33-3590-45a8-81d3-405784d2cb05", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "67481972-ce7c-451c-9e5e-83f66509e9de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "value": "311" + }, + { + "description": "Animal Food Manufacturing", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ed37f677-7ad1-412e-a3fc-30292a8152b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e2c808b9-3529-49fd-b7e9-3fbbf6bf3130", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b49eca3d-f7e6-471c-a9ee-d264c191da28", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f8194f33-3590-45a8-81d3-405784d2cb05", + "value": "3111" + }, + { + "description": "Animal Food Manufacturing", + "related": [ + { + "dest-uuid": "f8194f33-3590-45a8-81d3-405784d2cb05", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ed37f677-7ad1-412e-a3fc-30292a8152b1", + "value": "31111" + }, + { + "description": "Dog and Cat Food Manufacturing ", + "related": [ + { + "dest-uuid": "f8194f33-3590-45a8-81d3-405784d2cb05", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e2c808b9-3529-49fd-b7e9-3fbbf6bf3130", + "value": "311111" + }, + { + "description": "Other Animal Food Manufacturing ", + "related": [ + { + "dest-uuid": "f8194f33-3590-45a8-81d3-405784d2cb05", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b49eca3d-f7e6-471c-a9ee-d264c191da28", + "value": "311119" + }, + { + "description": "Grain and Oilseed Milling", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "84205ca9-7958-45e5-9d71-b616942e793e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "43797a40-ac36-444c-8cf1-750e34e31e9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f4ec3dd9-a1fd-49c0-851a-a97435701814", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "17a09f52-ca7f-4cba-a18f-a5eeae3173d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a8587d75-23c6-45f2-8357-96c7f852d987", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4502ac1e-134e-4cbf-8e16-10c4a71c7a61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fcd6e10e-f55f-461e-a1a7-6be7ce22ff02", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e550f66c-6ccf-41b8-a038-c5f417c914da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "da2d5deb-261a-4f9a-89ca-18a2da50a9e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b04c0f9a-cac9-4342-aca5-07014a4810b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "value": "3112" + }, + { + "description": "Flour Milling and Malt Manufacturing", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "84205ca9-7958-45e5-9d71-b616942e793e", + "value": "31121" + }, + { + "description": "Flour Milling ", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "43797a40-ac36-444c-8cf1-750e34e31e9d", + "value": "311211" + }, + { + "description": "Rice Milling ", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f4ec3dd9-a1fd-49c0-851a-a97435701814", + "value": "311212" + }, + { + "description": "Malt Manufacturing ", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "17a09f52-ca7f-4cba-a18f-a5eeae3173d1", + "value": "311213" + }, + { + "description": "Starch and Vegetable Fats and Oils Manufacturing", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a8587d75-23c6-45f2-8357-96c7f852d987", + "value": "31122" + }, + { + "description": "Wet Corn Milling and Starch Manufacturing ", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4502ac1e-134e-4cbf-8e16-10c4a71c7a61", + "value": "311221" + }, + { + "description": "Soybean and Other Oilseed Processing ", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fcd6e10e-f55f-461e-a1a7-6be7ce22ff02", + "value": "311224" + }, + { + "description": "Fats and Oils Refining and Blending ", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e550f66c-6ccf-41b8-a038-c5f417c914da", + "value": "311225" + }, + { + "description": "Breakfast Cereal Manufacturing", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b04c0f9a-cac9-4342-aca5-07014a4810b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "da2d5deb-261a-4f9a-89ca-18a2da50a9e4", + "value": "31123" + }, + { + "description": "Breakfast Cereal Manufacturing", + "related": [ + { + "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "da2d5deb-261a-4f9a-89ca-18a2da50a9e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b04c0f9a-cac9-4342-aca5-07014a4810b3", + "value": "311230" + }, + { + "description": "Sugar and Confectionery Product Manufacturing", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b3d9e221-1542-45e3-8434-52f949c60e93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "79f427ba-6c9a-462b-889e-b6788442d624", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4c49dd93-4876-4bfc-97ec-02e9d8f1a431", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4243ee1d-9a13-4978-ac9d-5faedf55ecf7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "65235438-e71f-4264-85c4-fa23d31750c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "424bf18b-5c85-4d5a-b7ff-9c9396a1c6d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "444fbfcd-c96c-4116-9ec9-83a3df77c539", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "06aa5948-c268-41a6-9ce9-c573d4aab314", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "value": "3113" + }, + { + "description": "Sugar Manufacturing", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b3d9e221-1542-45e3-8434-52f949c60e93", + "value": "31131" + }, + { + "description": "Beet Sugar Manufacturing ", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "79f427ba-6c9a-462b-889e-b6788442d624", + "value": "311313" + }, + { + "description": "Cane Sugar Manufacturing ", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4c49dd93-4876-4bfc-97ec-02e9d8f1a431", + "value": "311314" + }, + { + "description": "Nonchocolate Confectionery Manufacturing", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "65235438-e71f-4264-85c4-fa23d31750c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4243ee1d-9a13-4978-ac9d-5faedf55ecf7", + "value": "31134" + }, + { + "description": "Nonchocolate Confectionery Manufacturing", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4243ee1d-9a13-4978-ac9d-5faedf55ecf7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "65235438-e71f-4264-85c4-fa23d31750c6", + "value": "311340" + }, + { + "description": "Chocolate and Confectionery Manufacturing", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "424bf18b-5c85-4d5a-b7ff-9c9396a1c6d0", + "value": "31135" + }, + { + "description": "Chocolate and Confectionery Manufacturing from Cacao Beans ", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "444fbfcd-c96c-4116-9ec9-83a3df77c539", + "value": "311351" + }, + { + "description": "Confectionery Manufacturing from Purchased Chocolate ", + "related": [ + { + "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "06aa5948-c268-41a6-9ce9-c573d4aab314", + "value": "311352" + }, + { + "description": "Fruit and Vegetable Preserving and Specialty Food Manufacturing", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "34eec498-450c-43f1-96b2-a8b6c20bb05d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9a27932e-c1f3-4cf4-9d1c-b08e9bfc9197", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8cf99dcd-edd1-4488-9be1-1296c27c3fbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a92f3084-6e90-438d-98dc-a3466ca36038", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2769ce73-718a-4aab-b623-203f5952121b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "28f22ca1-508d-47b6-875f-14a3a6f64877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6d2da4d1-0838-48c3-9e9c-bdc488f80527", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "value": "3114" + }, + { + "description": "Frozen Food Manufacturing", + "related": [ + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "34eec498-450c-43f1-96b2-a8b6c20bb05d", + "value": "31141" + }, + { + "description": "Frozen Fruit, Juice, and Vegetable Manufacturing ", + "related": [ + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9a27932e-c1f3-4cf4-9d1c-b08e9bfc9197", + "value": "311411" + }, + { + "description": "Frozen Specialty Food Manufacturing ", + "related": [ + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8cf99dcd-edd1-4488-9be1-1296c27c3fbb", + "value": "311412" + }, + { + "description": "Fruit and Vegetable Canning, Pickling, and Drying", + "related": [ + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a92f3084-6e90-438d-98dc-a3466ca36038", + "value": "31142" + }, + { + "description": "Fruit and Vegetable Canning ", + "related": [ + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2769ce73-718a-4aab-b623-203f5952121b", + "value": "311421" + }, + { + "description": "Specialty Canning ", + "related": [ + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "28f22ca1-508d-47b6-875f-14a3a6f64877", + "value": "311422" + }, + { + "description": "Dried and Dehydrated Food Manufacturing ", + "related": [ + { + "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6d2da4d1-0838-48c3-9e9c-bdc488f80527", + "value": "311423" + }, + { + "description": "Dairy Product Manufacturing", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eaf7803d-4e4a-477c-b84b-8059b8bda601", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "573ba6c3-7734-4974-95ad-f72af23747a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a1a4352-293b-47cf-b4b6-eeff1028f9d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f9047c98-8146-40d2-bf19-97b3d4f05176", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1b16341d-2f96-406d-9378-cdb8e9bc9997", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ba8e09e7-1736-48e2-a048-41e784f7b24a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f7771707-3bf7-43d1-9252-6cb3e683dbd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "value": "3115" + }, + { + "description": "Dairy Product (except Frozen) Manufacturing", + "related": [ + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "eaf7803d-4e4a-477c-b84b-8059b8bda601", + "value": "31151" + }, + { + "description": "Fluid Milk Manufacturing ", + "related": [ + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "573ba6c3-7734-4974-95ad-f72af23747a3", + "value": "311511" + }, + { + "description": "Creamery Butter Manufacturing ", + "related": [ + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8a1a4352-293b-47cf-b4b6-eeff1028f9d0", + "value": "311512" + }, + { + "description": "Cheese Manufacturing ", + "related": [ + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f9047c98-8146-40d2-bf19-97b3d4f05176", + "value": "311513" + }, + { + "description": "Dry, Condensed, and Evaporated Dairy Product Manufacturing ", + "related": [ + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1b16341d-2f96-406d-9378-cdb8e9bc9997", + "value": "311514" + }, + { + "description": "Ice Cream and Frozen Dessert Manufacturing", + "related": [ + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f7771707-3bf7-43d1-9252-6cb3e683dbd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ba8e09e7-1736-48e2-a048-41e784f7b24a", + "value": "31152" + }, + { + "description": "Ice Cream and Frozen Dessert Manufacturing", + "related": [ + { + "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ba8e09e7-1736-48e2-a048-41e784f7b24a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f7771707-3bf7-43d1-9252-6cb3e683dbd1", + "value": "311520" + }, + { + "description": "Animal Slaughtering and Processing", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "657b50bb-c8c0-49e3-ad0f-ad67fec20f74", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "70960486-7201-41b5-9075-ef32cac9fd1b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7b8a7bd5-da57-4c60-bdda-ec67d6147152", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "14c50435-a9c5-4a5d-91f1-e3b2e904f680", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "06ff0e57-c8ce-47c5-9dac-9d54fc8914db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "09b5d705-873d-4b21-baf7-fa838491429f", + "value": "3116" + }, + { + "description": "Animal Slaughtering and Processing", + "related": [ + { + "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "657b50bb-c8c0-49e3-ad0f-ad67fec20f74", + "value": "31161" + }, + { + "description": "Animal (except Poultry) Slaughtering ", + "related": [ + { + "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "70960486-7201-41b5-9075-ef32cac9fd1b", + "value": "311611" + }, + { + "description": "Meat Processed from Carcasses ", + "related": [ + { + "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7b8a7bd5-da57-4c60-bdda-ec67d6147152", + "value": "311612" + }, + { + "description": "Rendering and Meat Byproduct Processing ", + "related": [ + { + "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "14c50435-a9c5-4a5d-91f1-e3b2e904f680", + "value": "311613" + }, + { + "description": "Poultry Processing ", + "related": [ + { + "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "06ff0e57-c8ce-47c5-9dac-9d54fc8914db", + "value": "311615" + }, + { + "description": "Seafood Product Preparation and Packaging", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b1c98ad0-8212-482d-a784-0e09b82b1887", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d7de1721-a0b3-48e8-a5c5-bf26f0356f32", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "67481972-ce7c-451c-9e5e-83f66509e9de", + "value": "3117" + }, + { + "description": "Seafood Product Preparation and Packaging", + "related": [ + { + "dest-uuid": "67481972-ce7c-451c-9e5e-83f66509e9de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d7de1721-a0b3-48e8-a5c5-bf26f0356f32", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b1c98ad0-8212-482d-a784-0e09b82b1887", + "value": "31171" + }, + { + "description": "Seafood Product Preparation and Packaging", + "related": [ + { + "dest-uuid": "67481972-ce7c-451c-9e5e-83f66509e9de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b1c98ad0-8212-482d-a784-0e09b82b1887", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d7de1721-a0b3-48e8-a5c5-bf26f0356f32", + "value": "311710" + }, + { + "description": "Bakeries and Tortilla Manufacturing", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d347372e-e26c-4bc1-a5f8-65243202f108", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "33575179-f6ad-48ec-b461-3e79d23519c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "61f079b1-29f6-485f-9b87-9cbce10e9ae2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9d2cd391-3cbe-4516-904e-6eaebf2cea4c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d3d51c3c-ad85-4335-af62-13261cdd3956", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "260bef26-59e3-4c73-b5a0-bf95eeccb98a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2a77f356-03f6-4460-9ad6-1f751b665914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aaee91f2-eae9-4bcc-90c4-e21cb16bb129", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a47c6697-6a38-4ca7-9779-8dff73fd7dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "value": "3118" + }, + { + "description": "Bread and Bakery Product Manufacturing", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d347372e-e26c-4bc1-a5f8-65243202f108", + "value": "31181" + }, + { + "description": "Retail Bakeries ", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "33575179-f6ad-48ec-b461-3e79d23519c4", + "value": "311811" + }, + { + "description": "Commercial Bakeries ", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "61f079b1-29f6-485f-9b87-9cbce10e9ae2", + "value": "311812" + }, + { + "description": "Frozen Cakes, Pies, and Other Pastries Manufacturing ", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9d2cd391-3cbe-4516-904e-6eaebf2cea4c", + "value": "311813" + }, + { + "description": "Cookie, Cracker, and Pasta Manufacturing", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d3d51c3c-ad85-4335-af62-13261cdd3956", + "value": "31182" + }, + { + "description": "Cookie and Cracker Manufacturing ", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "260bef26-59e3-4c73-b5a0-bf95eeccb98a", + "value": "311821" + }, + { + "description": "Dry Pasta, Dough, and Flour Mixes Manufacturing from Purchased Flour ", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2a77f356-03f6-4460-9ad6-1f751b665914", + "value": "311824" + }, + { + "description": "Tortilla Manufacturing", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a47c6697-6a38-4ca7-9779-8dff73fd7dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "aaee91f2-eae9-4bcc-90c4-e21cb16bb129", + "value": "31183" + }, + { + "description": "Tortilla Manufacturing", + "related": [ + { + "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aaee91f2-eae9-4bcc-90c4-e21cb16bb129", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a47c6697-6a38-4ca7-9779-8dff73fd7dd1", + "value": "311830" + }, + { + "description": "Other Food Manufacturing", + "related": [ + { + "dest-uuid": "e0a8dd36-4b26-4314-aacf-17ff5be29de2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5e4c8649-0014-4434-b53a-8765f0a62d16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "550dfafd-c142-403f-b964-da72b76a37de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "64e7c260-e006-48a8-bb73-7a34e7779259", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b6f6b5a1-ee2e-4e93-abb7-f1f87aa0fb5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a41057e-dba4-45e1-8df8-a16bd622be5c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "edb3c231-49e4-4152-a815-9cc38a4bd804", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8befc499-4608-4a74-bcb7-1754190b946c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b8ab6cf9-cffd-4ae5-9dcb-3c459c2c2e73", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "050fcafb-cf53-473a-b937-f4e8afd83026", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1488b046-dcb4-40e6-933b-77e6f8b9fed1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2021266d-340e-41d7-a160-6dd70bdf5afc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ab48593a-4784-4985-8904-61df67e09d5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a029d4db-ec75-485e-93eb-629a310b7349", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "value": "3119" + }, + { + "description": "Snack Food Manufacturing", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5e4c8649-0014-4434-b53a-8765f0a62d16", + "value": "31191" + }, + { + "description": "Roasted Nuts and Peanut Butter Manufacturing ", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "550dfafd-c142-403f-b964-da72b76a37de", + "value": "311911" + }, + { + "description": "Other Snack Food Manufacturing ", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "64e7c260-e006-48a8-bb73-7a34e7779259", + "value": "311919" + }, + { + "description": "Coffee and Tea Manufacturing", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8a41057e-dba4-45e1-8df8-a16bd622be5c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b6f6b5a1-ee2e-4e93-abb7-f1f87aa0fb5d", + "value": "31192" + }, + { + "description": "Coffee and Tea Manufacturing ", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b6f6b5a1-ee2e-4e93-abb7-f1f87aa0fb5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8a41057e-dba4-45e1-8df8-a16bd622be5c", + "value": "311920" + }, + { + "description": "Flavoring Syrup and Concentrate Manufacturing", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8befc499-4608-4a74-bcb7-1754190b946c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "edb3c231-49e4-4152-a815-9cc38a4bd804", + "value": "31193" + }, + { + "description": "Flavoring Syrup and Concentrate Manufacturing", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "edb3c231-49e4-4152-a815-9cc38a4bd804", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8befc499-4608-4a74-bcb7-1754190b946c", + "value": "311930" + }, + { + "description": "Seasoning and Dressing Manufacturing", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b8ab6cf9-cffd-4ae5-9dcb-3c459c2c2e73", + "value": "31194" + }, + { + "description": "Mayonnaise, Dressing, and Other Prepared Sauce Manufacturing ", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "050fcafb-cf53-473a-b937-f4e8afd83026", + "value": "311941" + }, + { + "description": "Spice and Extract Manufacturing ", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1488b046-dcb4-40e6-933b-77e6f8b9fed1", + "value": "311942" + }, + { + "description": "All Other Food Manufacturing", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2021266d-340e-41d7-a160-6dd70bdf5afc", + "value": "31199" + }, + { + "description": "Perishable Prepared Food Manufacturing ", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ab48593a-4784-4985-8904-61df67e09d5a", + "value": "311991" + }, + { + "description": "All Other Miscellaneous Food Manufacturing ", + "related": [ + { + "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a029d4db-ec75-485e-93eb-629a310b7349", + "value": "311999" + }, + { + "description": "Beverage and Tobacco Product Manufacturing", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bba2d5b5-f7a9-4763-9cef-868fb4c425de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f23b2515-93c5-4ab3-a849-4cf5858c07f2", + "value": "312" + }, + { + "description": "Beverage Manufacturing", + "related": [ + { + "dest-uuid": "f23b2515-93c5-4ab3-a849-4cf5858c07f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "895b32f8-7525-461c-9327-cf5820615a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aec3771e-4d6a-4967-96d5-049de8d26f08", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7fc0014d-0e95-4e56-88e1-a03e0c6b4550", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bd6a19b9-6df6-4514-906f-bff7101a875d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "72aea3ac-b960-4062-b1e4-6336a92fb2a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a97894dd-fc71-44e3-94d7-9993e8dfb09e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "300ccbe6-a051-46b5-afaf-d7dd39c1b54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e226f9ff-61e3-4f2e-be74-aa3cca7768e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0ac1da02-e6b3-4676-8052-ea695e287873", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "665b0d51-f777-4a08-80bd-d4d85b784dff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "value": "3121" + }, + { + "description": "Soft Drink and Ice Manufacturing", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "895b32f8-7525-461c-9327-cf5820615a29", + "value": "31211" + }, + { + "description": "Soft Drink Manufacturing ", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "aec3771e-4d6a-4967-96d5-049de8d26f08", + "value": "312111" + }, + { + "description": "Bottled Water Manufacturing ", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7fc0014d-0e95-4e56-88e1-a03e0c6b4550", + "value": "312112" + }, + { + "description": "Ice Manufacturing ", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bd6a19b9-6df6-4514-906f-bff7101a875d", + "value": "312113" + }, + { + "description": "Breweries", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a97894dd-fc71-44e3-94d7-9993e8dfb09e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "72aea3ac-b960-4062-b1e4-6336a92fb2a1", + "value": "31212" + }, + { + "description": "Breweries", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "72aea3ac-b960-4062-b1e4-6336a92fb2a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a97894dd-fc71-44e3-94d7-9993e8dfb09e", + "value": "312120" + }, + { + "description": "Wineries", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e226f9ff-61e3-4f2e-be74-aa3cca7768e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "300ccbe6-a051-46b5-afaf-d7dd39c1b54c", + "value": "31213" + }, + { + "description": "Wineries ", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "300ccbe6-a051-46b5-afaf-d7dd39c1b54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e226f9ff-61e3-4f2e-be74-aa3cca7768e6", + "value": "312130" + }, + { + "description": "Distilleries", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "665b0d51-f777-4a08-80bd-d4d85b784dff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0ac1da02-e6b3-4676-8052-ea695e287873", + "value": "31214" + }, + { + "description": "Distilleries ", + "related": [ + { + "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0ac1da02-e6b3-4676-8052-ea695e287873", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "665b0d51-f777-4a08-80bd-d4d85b784dff", + "value": "312140" + }, + { + "description": "Tobacco Manufacturing", + "related": [ + { + "dest-uuid": "f23b2515-93c5-4ab3-a849-4cf5858c07f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9b4c3a1c-c0e0-4e68-84e2-ca42dcd98157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "abfab4d5-1f53-455a-83fb-923e4342a0d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bba2d5b5-f7a9-4763-9cef-868fb4c425de", + "value": "3122" + }, + { + "description": "Tobacco Manufacturing", + "related": [ + { + "dest-uuid": "bba2d5b5-f7a9-4763-9cef-868fb4c425de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "abfab4d5-1f53-455a-83fb-923e4342a0d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9b4c3a1c-c0e0-4e68-84e2-ca42dcd98157", + "value": "31223" + }, + { + "description": "Tobacco Manufacturing ", + "related": [ + { + "dest-uuid": "bba2d5b5-f7a9-4763-9cef-868fb4c425de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9b4c3a1c-c0e0-4e68-84e2-ca42dcd98157", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "abfab4d5-1f53-455a-83fb-923e4342a0d0", + "value": "312230" + }, + { + "description": "Textile Mills", + "related": [ + { + "dest-uuid": "7be74537-3e51-44f3-bf38-9cb3889f4015", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a54cd85c-5a48-4378-8340-b92ac15eeba3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b7c10ff7-470d-4f62-8f98-fe8d85a66917", + "value": "313" + }, + { + "description": "Fiber, Yarn, and Thread Mills", + "related": [ + { + "dest-uuid": "b7c10ff7-470d-4f62-8f98-fe8d85a66917", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "58e9f88b-c52f-4c50-b5f7-6fa1da60ebc7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "14fbc14b-ba28-402c-a6e2-f65f7d53bfc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7be74537-3e51-44f3-bf38-9cb3889f4015", + "value": "3131" + }, + { + "description": "Fiber, Yarn, and Thread Mills", + "related": [ + { + "dest-uuid": "7be74537-3e51-44f3-bf38-9cb3889f4015", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "14fbc14b-ba28-402c-a6e2-f65f7d53bfc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "58e9f88b-c52f-4c50-b5f7-6fa1da60ebc7", + "value": "31311" + }, + { + "description": "Fiber, Yarn, and Thread Mills ", + "related": [ + { + "dest-uuid": "7be74537-3e51-44f3-bf38-9cb3889f4015", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "58e9f88b-c52f-4c50-b5f7-6fa1da60ebc7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "14fbc14b-ba28-402c-a6e2-f65f7d53bfc5", + "value": "313110" + }, + { + "description": "Fabric Mills", + "related": [ + { + "dest-uuid": "b7c10ff7-470d-4f62-8f98-fe8d85a66917", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "146337a7-e9a3-452f-9550-5b3c9abfd05a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0ba88673-4d71-4cf9-ae42-f7aa5337f5a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7a0a4617-82df-4f7c-9160-f2b7f84a2874", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "36fe7c23-ea8d-4ead-bc24-a6a44006e0a4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0f1e3387-c012-4201-bffe-77cf6e7b5a87", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8b5f0127-4b3e-47d1-97fd-6f014e3bb352", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c91f8d9b-85a7-475b-8a0f-cfbc4e05cfea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "918a1827-1623-4e23-beb6-4577e665b071", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "value": "3132" + }, + { + "description": "Broadwoven Fabric Mills", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0ba88673-4d71-4cf9-ae42-f7aa5337f5a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "146337a7-e9a3-452f-9550-5b3c9abfd05a", + "value": "31321" + }, + { + "description": "Broadwoven Fabric Mills", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "146337a7-e9a3-452f-9550-5b3c9abfd05a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0ba88673-4d71-4cf9-ae42-f7aa5337f5a6", + "value": "313210" + }, + { + "description": "Narrow Fabric Mills and Schiffli Machine Embroidery", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "36fe7c23-ea8d-4ead-bc24-a6a44006e0a4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7a0a4617-82df-4f7c-9160-f2b7f84a2874", + "value": "31322" + }, + { + "description": "Narrow Fabric Mills and Schiffli Machine Embroidery", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7a0a4617-82df-4f7c-9160-f2b7f84a2874", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "36fe7c23-ea8d-4ead-bc24-a6a44006e0a4", + "value": "313220" + }, + { + "description": "Nonwoven Fabric Mills", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8b5f0127-4b3e-47d1-97fd-6f014e3bb352", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0f1e3387-c012-4201-bffe-77cf6e7b5a87", + "value": "31323" + }, + { + "description": "Nonwoven Fabric Mills", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0f1e3387-c012-4201-bffe-77cf6e7b5a87", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8b5f0127-4b3e-47d1-97fd-6f014e3bb352", + "value": "313230" + }, + { + "description": "Knit Fabric Mills", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "918a1827-1623-4e23-beb6-4577e665b071", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c91f8d9b-85a7-475b-8a0f-cfbc4e05cfea", + "value": "31324" + }, + { + "description": "Knit Fabric Mills", + "related": [ + { + "dest-uuid": "492d6ae9-1638-484d-a39c-91600f8b70f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c91f8d9b-85a7-475b-8a0f-cfbc4e05cfea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "918a1827-1623-4e23-beb6-4577e665b071", + "value": "313240" + }, + { + "description": "Textile and Fabric Finishing and Fabric Coating Mills", + "related": [ + { + "dest-uuid": "b7c10ff7-470d-4f62-8f98-fe8d85a66917", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b400fe34-093a-40eb-a0b0-d3302c511e43", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "406646e3-4ef4-42bf-9a48-f19af2740383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aaeda1eb-4dfe-4793-a1e2-1beeec8b3d18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b9a96005-04c0-42cd-a601-1c522ec99575", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a54cd85c-5a48-4378-8340-b92ac15eeba3", + "value": "3133" + }, + { + "description": "Textile and Fabric Finishing Mills", + "related": [ + { + "dest-uuid": "a54cd85c-5a48-4378-8340-b92ac15eeba3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "406646e3-4ef4-42bf-9a48-f19af2740383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b400fe34-093a-40eb-a0b0-d3302c511e43", + "value": "31331" + }, + { + "description": "Textile and Fabric Finishing Mills ", + "related": [ + { + "dest-uuid": "a54cd85c-5a48-4378-8340-b92ac15eeba3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b400fe34-093a-40eb-a0b0-d3302c511e43", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "406646e3-4ef4-42bf-9a48-f19af2740383", + "value": "313310" + }, + { + "description": "Fabric Coating Mills", + "related": [ + { + "dest-uuid": "a54cd85c-5a48-4378-8340-b92ac15eeba3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b9a96005-04c0-42cd-a601-1c522ec99575", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "aaeda1eb-4dfe-4793-a1e2-1beeec8b3d18", + "value": "31332" + }, + { + "description": "Fabric Coating Mills", + "related": [ + { + "dest-uuid": "a54cd85c-5a48-4378-8340-b92ac15eeba3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aaeda1eb-4dfe-4793-a1e2-1beeec8b3d18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b9a96005-04c0-42cd-a601-1c522ec99575", + "value": "313320" + }, + { + "description": "Textile Product Mills", + "related": [ + { + "dest-uuid": "3fb73bd3-3a5d-416f-8e63-83b88ede18d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ae100957-bf18-4df8-b820-dce82a56dc2f", + "value": "314" + }, + { + "description": "Textile Furnishings Mills", + "related": [ + { + "dest-uuid": "ae100957-bf18-4df8-b820-dce82a56dc2f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2e76c97f-dafa-4bf2-9e5e-7bab525ae6be", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "94b614da-6516-4fec-a29d-6e50e157ec97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1bdbf9a1-14c2-410e-9b37-94489dac8aaa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9f9557b2-636b-4bb4-961f-3a2ccee02380", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3fb73bd3-3a5d-416f-8e63-83b88ede18d7", + "value": "3141" + }, + { + "description": "Carpet and Rug Mills", + "related": [ + { + "dest-uuid": "3fb73bd3-3a5d-416f-8e63-83b88ede18d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "94b614da-6516-4fec-a29d-6e50e157ec97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2e76c97f-dafa-4bf2-9e5e-7bab525ae6be", + "value": "31411" + }, + { + "description": "Carpet and Rug Mills", + "related": [ + { + "dest-uuid": "3fb73bd3-3a5d-416f-8e63-83b88ede18d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2e76c97f-dafa-4bf2-9e5e-7bab525ae6be", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "94b614da-6516-4fec-a29d-6e50e157ec97", + "value": "314110" + }, + { + "description": "Curtain and Linen Mills", + "related": [ + { + "dest-uuid": "3fb73bd3-3a5d-416f-8e63-83b88ede18d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9f9557b2-636b-4bb4-961f-3a2ccee02380", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1bdbf9a1-14c2-410e-9b37-94489dac8aaa", + "value": "31412" + }, + { + "description": "Curtain and Linen Mills", + "related": [ + { + "dest-uuid": "3fb73bd3-3a5d-416f-8e63-83b88ede18d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1bdbf9a1-14c2-410e-9b37-94489dac8aaa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9f9557b2-636b-4bb4-961f-3a2ccee02380", + "value": "314120" + }, + { + "description": "Other Textile Product Mills", + "related": [ + { + "dest-uuid": "ae100957-bf18-4df8-b820-dce82a56dc2f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8390241a-9cd9-4446-b3b2-bd7fd73895e3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "99bbf492-d460-4cb9-b6cb-9b8359b9e0aa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3fac7dbf-777d-423d-91a5-6711d655e1e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b1c05054-a2ef-4217-95e4-85f0c2596db8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a7e8e4c-69f5-4560-9f73-ac210e875711", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", + "value": "3149" + }, + { + "description": "Textile Bag and Canvas Mills", + "related": [ + { + "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "99bbf492-d460-4cb9-b6cb-9b8359b9e0aa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8390241a-9cd9-4446-b3b2-bd7fd73895e3", + "value": "31491" + }, + { + "description": "Textile Bag and Canvas Mills ", + "related": [ + { + "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8390241a-9cd9-4446-b3b2-bd7fd73895e3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "99bbf492-d460-4cb9-b6cb-9b8359b9e0aa", + "value": "314910" + }, + { + "description": "All Other Textile Product Mills", + "related": [ + { + "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3fac7dbf-777d-423d-91a5-6711d655e1e4", + "value": "31499" + }, + { + "description": "Rope, Cordage, Twine, Tire Cord, and Tire Fabric Mills ", + "related": [ + { + "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b1c05054-a2ef-4217-95e4-85f0c2596db8", + "value": "314994" + }, + { + "description": "All Other Miscellaneous Textile Product Mills ", + "related": [ + { + "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8a7e8e4c-69f5-4560-9f73-ac210e875711", + "value": "314999" + }, + { + "description": "Apparel Manufacturing", + "related": [ + { + "dest-uuid": "8cfa855b-5b65-41f5-932b-8234ab427a7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ab90ccd7-e096-4913-8066-5d97bf4c5108", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1db64860-1cec-464c-b516-e1555aaeefec", + "value": "315" + }, + { + "description": "Apparel Knitting Mills", + "related": [ + { + "dest-uuid": "1db64860-1cec-464c-b516-e1555aaeefec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "115f7d17-889d-45d9-b4e6-390b666ca4a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "76c840c1-a496-404f-9b6d-a46aa68f9353", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8cfa855b-5b65-41f5-932b-8234ab427a7c", + "value": "3151" + }, + { + "description": "Apparel Knitting Mills", + "related": [ + { + "dest-uuid": "8cfa855b-5b65-41f5-932b-8234ab427a7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "76c840c1-a496-404f-9b6d-a46aa68f9353", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "115f7d17-889d-45d9-b4e6-390b666ca4a1", + "value": "31512" + }, + { + "description": "Apparel Knitting Mills", + "related": [ + { + "dest-uuid": "8cfa855b-5b65-41f5-932b-8234ab427a7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "115f7d17-889d-45d9-b4e6-390b666ca4a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "76c840c1-a496-404f-9b6d-a46aa68f9353", + "value": "315120" + }, + { + "description": "Cut and Sew Apparel Manufacturing", + "related": [ + { + "dest-uuid": "1db64860-1cec-464c-b516-e1555aaeefec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7127ba24-a5e9-4706-960d-a76e0b35c259", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d0fe2eea-30ba-40a8-b4e4-9f33e5db8959", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dc18e539-915e-4321-9c31-6b89067630f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a786e7c7-865d-4bb8-84c7-747e9c8ceefb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", + "value": "3152" + }, + { + "description": "Cut and Sew Apparel Contractors ", + "related": [ + { + "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d0fe2eea-30ba-40a8-b4e4-9f33e5db8959", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7127ba24-a5e9-4706-960d-a76e0b35c259", + "value": "31521" + }, + { + "description": "Cut and Sew Apparel Contractors ", + "related": [ + { + "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7127ba24-a5e9-4706-960d-a76e0b35c259", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d0fe2eea-30ba-40a8-b4e4-9f33e5db8959", + "value": "315210" + }, + { + "description": "Cut and Sew Apparel Manufacturing (except Contractors) ", + "related": [ + { + "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a786e7c7-865d-4bb8-84c7-747e9c8ceefb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dc18e539-915e-4321-9c31-6b89067630f9", + "value": "31525" + }, + { + "description": "Cut and Sew Apparel Manufacturing (except Contractors) ", + "related": [ + { + "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dc18e539-915e-4321-9c31-6b89067630f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a786e7c7-865d-4bb8-84c7-747e9c8ceefb", + "value": "315250" + }, + { + "description": "Apparel Accessories and Other Apparel Manufacturing", + "related": [ + { + "dest-uuid": "1db64860-1cec-464c-b516-e1555aaeefec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "858db96f-bb55-43af-ab28-91dc96203300", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "77ab5584-4f4d-4f63-ace6-637d72121344", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ab90ccd7-e096-4913-8066-5d97bf4c5108", + "value": "3159" + }, + { + "description": "Apparel Accessories and Other Apparel Manufacturing", + "related": [ + { + "dest-uuid": "ab90ccd7-e096-4913-8066-5d97bf4c5108", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "77ab5584-4f4d-4f63-ace6-637d72121344", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "858db96f-bb55-43af-ab28-91dc96203300", + "value": "31599" + }, + { + "description": "Apparel Accessories and Other Apparel Manufacturing ", + "related": [ + { + "dest-uuid": "ab90ccd7-e096-4913-8066-5d97bf4c5108", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "858db96f-bb55-43af-ab28-91dc96203300", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "77ab5584-4f4d-4f63-ace6-637d72121344", + "value": "315990" + }, + { + "description": "Leather and Allied Product Manufacturing", + "related": [ + { + "dest-uuid": "62f0cb52-df3f-4f89-8343-51970fdc3d7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fe4e4e08-df2c-422e-bbfb-471afdc2f0d6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4eab73bb-043c-4565-889d-4672aabac991", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "97edc125-ed21-423b-9bdb-6ae7f92e739f", + "value": "316" + }, + { + "description": "Leather and Hide Tanning and Finishing", + "related": [ + { + "dest-uuid": "97edc125-ed21-423b-9bdb-6ae7f92e739f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9c78e6c4-f619-4672-96c0-1d746e6efc79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2a6de13f-cc06-48a9-9915-c4053f098fed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "62f0cb52-df3f-4f89-8343-51970fdc3d7c", + "value": "3161" + }, + { + "description": "Leather and Hide Tanning and Finishing", + "related": [ + { + "dest-uuid": "62f0cb52-df3f-4f89-8343-51970fdc3d7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2a6de13f-cc06-48a9-9915-c4053f098fed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9c78e6c4-f619-4672-96c0-1d746e6efc79", + "value": "31611" + }, + { + "description": "Leather and Hide Tanning and Finishing", + "related": [ + { + "dest-uuid": "62f0cb52-df3f-4f89-8343-51970fdc3d7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9c78e6c4-f619-4672-96c0-1d746e6efc79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2a6de13f-cc06-48a9-9915-c4053f098fed", + "value": "316110" + }, + { + "description": "Footwear Manufacturing", + "related": [ + { + "dest-uuid": "97edc125-ed21-423b-9bdb-6ae7f92e739f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ba19a71c-30df-4e08-94ba-c529f6201974", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2002633d-d403-4461-a0f8-54222883f668", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "fe4e4e08-df2c-422e-bbfb-471afdc2f0d6", + "value": "3162" + }, + { + "description": "Footwear Manufacturing", + "related": [ + { + "dest-uuid": "fe4e4e08-df2c-422e-bbfb-471afdc2f0d6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2002633d-d403-4461-a0f8-54222883f668", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ba19a71c-30df-4e08-94ba-c529f6201974", + "value": "31621" + }, + { + "description": "Footwear Manufacturing ", + "related": [ + { + "dest-uuid": "fe4e4e08-df2c-422e-bbfb-471afdc2f0d6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ba19a71c-30df-4e08-94ba-c529f6201974", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2002633d-d403-4461-a0f8-54222883f668", + "value": "316210" + }, + { + "description": "Other Leather and Allied Product Manufacturing", + "related": [ + { + "dest-uuid": "97edc125-ed21-423b-9bdb-6ae7f92e739f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1256f0c0-222d-42b2-a05d-4fa8ab70f718", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "807b507c-a9f8-484a-b58e-79e5d2a073e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4eab73bb-043c-4565-889d-4672aabac991", + "value": "3169" + }, + { + "description": "Other Leather and Allied Product Manufacturing", + "related": [ + { + "dest-uuid": "4eab73bb-043c-4565-889d-4672aabac991", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "807b507c-a9f8-484a-b58e-79e5d2a073e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1256f0c0-222d-42b2-a05d-4fa8ab70f718", + "value": "31699" + }, + { + "description": "Other Leather and Allied Product Manufacturing ", + "related": [ + { + "dest-uuid": "4eab73bb-043c-4565-889d-4672aabac991", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1256f0c0-222d-42b2-a05d-4fa8ab70f718", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "807b507c-a9f8-484a-b58e-79e5d2a073e4", + "value": "316990" + }, + { + "description": "Wood Product Manufacturing", + "related": [ + { + "dest-uuid": "4b143202-d0c3-48dd-acee-7e7abbae972e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "abec424c-403d-4fad-85c4-d2b802f1e524", + "value": "321" + }, + { + "description": "Sawmills and Wood Preservation", + "related": [ + { + "dest-uuid": "abec424c-403d-4fad-85c4-d2b802f1e524", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4e0c770b-2132-4ecb-a85a-0bb925a666c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8d484f87-7025-45bf-87df-8572b6c39dd8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1a1a9201-9eb6-44c3-8ed7-b814169def36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4b143202-d0c3-48dd-acee-7e7abbae972e", + "value": "3211" + }, + { + "description": "Sawmills and Wood Preservation", + "related": [ + { + "dest-uuid": "4b143202-d0c3-48dd-acee-7e7abbae972e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4e0c770b-2132-4ecb-a85a-0bb925a666c7", + "value": "32111" + }, + { + "description": "Sawmills ", + "related": [ + { + "dest-uuid": "4b143202-d0c3-48dd-acee-7e7abbae972e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8d484f87-7025-45bf-87df-8572b6c39dd8", + "value": "321113" + }, + { + "description": "Wood Preservation ", + "related": [ + { + "dest-uuid": "4b143202-d0c3-48dd-acee-7e7abbae972e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1a1a9201-9eb6-44c3-8ed7-b814169def36", + "value": "321114" + }, + { + "description": "Veneer, Plywood, and Engineered Wood Product Manufacturing", + "related": [ + { + "dest-uuid": "abec424c-403d-4fad-85c4-d2b802f1e524", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3053546e-a85a-4414-8af1-1d9b7dab141c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4709ed92-c444-4d21-ad41-be8030cc7af3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1a3ec4db-ef39-4717-a25e-785e16f391a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dedb30f9-5610-4716-86a9-2c2f8d1bf173", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b86e4a7e-bf08-45ff-bd4f-da674ec0231b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0827f265-cfb4-4991-98c9-f678f908a486", + "value": "3212" + }, + { + "description": "Veneer, Plywood, and Engineered Wood Product Manufacturing", + "related": [ + { + "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3053546e-a85a-4414-8af1-1d9b7dab141c", + "value": "32121" + }, + { + "description": "Hardwood Veneer and Plywood Manufacturing ", + "related": [ + { + "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4709ed92-c444-4d21-ad41-be8030cc7af3", + "value": "321211" + }, + { + "description": "Softwood Veneer and Plywood Manufacturing ", + "related": [ + { + "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1a3ec4db-ef39-4717-a25e-785e16f391a3", + "value": "321212" + }, + { + "description": "Engineered Wood Member Manufacturing ", + "related": [ + { + "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dedb30f9-5610-4716-86a9-2c2f8d1bf173", + "value": "321215" + }, + { + "description": "Reconstituted Wood Product Manufacturing ", + "related": [ + { + "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b86e4a7e-bf08-45ff-bd4f-da674ec0231b", + "value": "321219" + }, + { + "description": "Other Wood Product Manufacturing", + "related": [ + { + "dest-uuid": "abec424c-403d-4fad-85c4-d2b802f1e524", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9ae666ed-c688-4165-935c-bedb8bead321", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dcca8b70-2beb-474a-9f93-35ea76631f45", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c4ae64e6-9c60-469b-a24d-3ef7c8f2971d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2e034d77-8161-4a23-a3b4-b6134759e659", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c8f1aedb-87fa-4356-8de6-c02c63fd9243", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "21d7e018-02af-4899-b5a6-035876cee89d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "94f0f3c9-3dd7-4f34-9a15-5a4577bcde36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aafe1dc3-f6e1-4d73-97ea-95f59e3bb7f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "75006563-6397-4aad-a9b1-eedba779f026", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "198cacce-71ce-4642-b00b-65390a6fc056", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "value": "3219" + }, + { + "description": "Millwork", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9ae666ed-c688-4165-935c-bedb8bead321", + "value": "32191" + }, + { + "description": "Wood Window and Door Manufacturing ", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dcca8b70-2beb-474a-9f93-35ea76631f45", + "value": "321911" + }, + { + "description": "Cut Stock, Resawing Lumber, and Planing ", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c4ae64e6-9c60-469b-a24d-3ef7c8f2971d", + "value": "321912" + }, + { + "description": "Other Millwork (including Flooring) ", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2e034d77-8161-4a23-a3b4-b6134759e659", + "value": "321918" + }, + { + "description": "Wood Container and Pallet Manufacturing", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "21d7e018-02af-4899-b5a6-035876cee89d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c8f1aedb-87fa-4356-8de6-c02c63fd9243", + "value": "32192" + }, + { + "description": "Wood Container and Pallet Manufacturing", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8f1aedb-87fa-4356-8de6-c02c63fd9243", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "21d7e018-02af-4899-b5a6-035876cee89d", + "value": "321920" + }, + { + "description": "All Other Wood Product Manufacturing", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "94f0f3c9-3dd7-4f34-9a15-5a4577bcde36", + "value": "32199" + }, + { + "description": "Manufactured Home (Mobile Home) Manufacturing ", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "aafe1dc3-f6e1-4d73-97ea-95f59e3bb7f9", + "value": "321991" + }, + { + "description": "Prefabricated Wood Building Manufacturing ", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "75006563-6397-4aad-a9b1-eedba779f026", + "value": "321992" + }, + { + "description": "All Other Miscellaneous Wood Product Manufacturing ", + "related": [ + { + "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "198cacce-71ce-4642-b00b-65390a6fc056", + "value": "321999" + }, + { + "description": "Paper Manufacturing", + "related": [ + { + "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8e51cff5-5a0e-49da-b48d-4040f5fde814", + "value": "322" + }, + { + "description": "Pulp, Paper, and Paperboard Mills", + "related": [ + { + "dest-uuid": "8e51cff5-5a0e-49da-b48d-4040f5fde814", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cbe28805-078b-450c-aa21-bba0cfa422b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1ec600cf-83a7-455e-abed-732d0f17585d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "06b56654-eeb8-4de5-8090-9dedb0c840ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e62bd62f-9887-4936-a6a5-f0e6339e7281", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ddad8fc6-1fba-4bb3-9ef0-b5558ab970af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "97329389-2fa6-4c18-9110-378d80c67bf1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "value": "3221" + }, + { + "description": "Pulp Mills", + "related": [ + { + "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1ec600cf-83a7-455e-abed-732d0f17585d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cbe28805-078b-450c-aa21-bba0cfa422b4", + "value": "32211" + }, + { + "description": "Pulp Mills ", + "related": [ + { + "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cbe28805-078b-450c-aa21-bba0cfa422b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1ec600cf-83a7-455e-abed-732d0f17585d", + "value": "322110" + }, + { + "description": "Paper Mills", + "related": [ + { + "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e62bd62f-9887-4936-a6a5-f0e6339e7281", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "06b56654-eeb8-4de5-8090-9dedb0c840ab", + "value": "32212" + }, + { + "description": "Paper Mills ", + "related": [ + { + "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "06b56654-eeb8-4de5-8090-9dedb0c840ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e62bd62f-9887-4936-a6a5-f0e6339e7281", + "value": "322120" + }, + { + "description": "Paperboard Mills", + "related": [ + { + "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "97329389-2fa6-4c18-9110-378d80c67bf1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ddad8fc6-1fba-4bb3-9ef0-b5558ab970af", + "value": "32213" + }, + { + "description": "Paperboard Mills ", + "related": [ + { + "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddad8fc6-1fba-4bb3-9ef0-b5558ab970af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "97329389-2fa6-4c18-9110-378d80c67bf1", + "value": "322130" + }, + { + "description": "Converted Paper Product Manufacturing", + "related": [ + { + "dest-uuid": "8e51cff5-5a0e-49da-b48d-4040f5fde814", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aa79d3b7-b621-47ab-8906-3478e0cea06b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8389e0e5-eb25-43ba-b5d6-9846a57491e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9938bfc8-25db-4c69-b783-6c0ba2f12f2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2040bc8b-7648-41c0-b43a-3fbc25cb12bc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b2438836-4ef2-4417-8c82-7fe928fbbf14", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "16612b24-177b-480c-9733-7ac31e6318cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7b5e995b-383c-49e7-8994-6e2993ea1b3a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "21b5d8ea-a47c-44c3-ae66-8fb0d1e95117", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8afdef17-1e56-4c58-80f7-754083b11df3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "986b270a-26be-4ef6-825f-57fe47060f8d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "050a2cab-4cab-4033-8203-6521dec9a12a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "value": "3222" + }, + { + "description": "Paperboard Container Manufacturing", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "aa79d3b7-b621-47ab-8906-3478e0cea06b", + "value": "32221" + }, + { + "description": "Corrugated and Solid Fiber Box Manufacturing ", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8389e0e5-eb25-43ba-b5d6-9846a57491e6", + "value": "322211" + }, + { + "description": "Folding Paperboard Box Manufacturing ", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9938bfc8-25db-4c69-b783-6c0ba2f12f2a", + "value": "322212" + }, + { + "description": "Other Paperboard Container Manufacturing ", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2040bc8b-7648-41c0-b43a-3fbc25cb12bc", + "value": "322219" + }, + { + "description": "Paper Bag and Coated and Treated Paper Manufacturing", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "16612b24-177b-480c-9733-7ac31e6318cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b2438836-4ef2-4417-8c82-7fe928fbbf14", + "value": "32222" + }, + { + "description": "Paper Bag and Coated and Treated Paper Manufacturing", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b2438836-4ef2-4417-8c82-7fe928fbbf14", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "16612b24-177b-480c-9733-7ac31e6318cc", + "value": "322220" + }, + { + "description": "Stationery Product Manufacturing", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "21b5d8ea-a47c-44c3-ae66-8fb0d1e95117", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7b5e995b-383c-49e7-8994-6e2993ea1b3a", + "value": "32223" + }, + { + "description": "Stationery Product Manufacturing", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7b5e995b-383c-49e7-8994-6e2993ea1b3a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "21b5d8ea-a47c-44c3-ae66-8fb0d1e95117", + "value": "322230" + }, + { + "description": "Other Converted Paper Product Manufacturing", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8afdef17-1e56-4c58-80f7-754083b11df3", + "value": "32229" + }, + { + "description": "Sanitary Paper Product Manufacturing ", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "986b270a-26be-4ef6-825f-57fe47060f8d", + "value": "322291" + }, + { + "description": "All Other Converted Paper Product Manufacturing ", + "related": [ + { + "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "050a2cab-4cab-4033-8203-6521dec9a12a", + "value": "322299" + }, + { + "description": "Printing and Related Support Activities", + "related": [ + { + "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8c309127-71e2-4cfb-9255-24f7ee56eede", + "value": "323" + }, + { + "description": "Printing and Related Support Activities", + "related": [ + { + "dest-uuid": "8c309127-71e2-4cfb-9255-24f7ee56eede", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d9a018a2-3095-4199-a449-d03906fd973b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cbeacba5-6d23-4f0b-ab71-becbfcddee10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3dae7713-1937-4150-a98e-2307bb01c9f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ddf39ea9-1d53-4cc0-84be-e9c8354d9f6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6dad127a-d04d-45f7-9e95-12f257c5a534", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a72a1d6a-41ec-4a92-8eb5-0cfc7367fa37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "value": "3231" + }, + { + "description": "Printing", + "related": [ + { + "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d9a018a2-3095-4199-a449-d03906fd973b", + "value": "32311" + }, + { + "description": "Commercial Printing (except Screen and Books) ", + "related": [ + { + "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cbeacba5-6d23-4f0b-ab71-becbfcddee10", + "value": "323111" + }, + { + "description": "Commercial Screen Printing ", + "related": [ + { + "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3dae7713-1937-4150-a98e-2307bb01c9f0", + "value": "323113" + }, + { + "description": "Books Printing ", + "related": [ + { + "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ddf39ea9-1d53-4cc0-84be-e9c8354d9f6d", + "value": "323117" + }, + { + "description": "Support Activities for Printing", + "related": [ + { + "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a72a1d6a-41ec-4a92-8eb5-0cfc7367fa37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6dad127a-d04d-45f7-9e95-12f257c5a534", + "value": "32312" + }, + { + "description": "Support Activities for Printing", + "related": [ + { + "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6dad127a-d04d-45f7-9e95-12f257c5a534", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a72a1d6a-41ec-4a92-8eb5-0cfc7367fa37", + "value": "323120" + }, + { + "description": "Petroleum and Coal Products Manufacturing", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8e4c9591-b8a2-4cdf-934b-b9777b276fed", + "value": "324" + }, + { + "description": "Petroleum and Coal Products Manufacturing", + "related": [ + { + "dest-uuid": "8e4c9591-b8a2-4cdf-934b-b9777b276fed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aec76a6d-31b6-43c9-bbe3-fbd86c3f5dd0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "14dc0ede-eac6-462c-9fb1-b6675dda7bf9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e333e64b-aeac-45ea-9a85-957eea73d44b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d61d8416-a237-4bb5-b786-39d76c290086", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "86a92551-4159-40ff-a342-345404f4de67", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "df73b609-4b12-4d76-be37-ad0bcba66df0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5422c79c-17b3-4594-aded-7a7caa9308af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "054c625f-721e-4233-a916-056759ce0305", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "value": "3241" + }, + { + "description": "Petroleum Refineries", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "14dc0ede-eac6-462c-9fb1-b6675dda7bf9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "aec76a6d-31b6-43c9-bbe3-fbd86c3f5dd0", + "value": "32411" + }, + { + "description": "Petroleum Refineries", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aec76a6d-31b6-43c9-bbe3-fbd86c3f5dd0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "14dc0ede-eac6-462c-9fb1-b6675dda7bf9", + "value": "324110" + }, + { + "description": "Asphalt Paving, Roofing, and Saturated Materials Manufacturing", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e333e64b-aeac-45ea-9a85-957eea73d44b", + "value": "32412" + }, + { + "description": "Asphalt Paving Mixture and Block Manufacturing ", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d61d8416-a237-4bb5-b786-39d76c290086", + "value": "324121" + }, + { + "description": "Asphalt Shingle and Coating Materials Manufacturing ", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "86a92551-4159-40ff-a342-345404f4de67", + "value": "324122" + }, + { + "description": "Other Petroleum and Coal Products Manufacturing", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "df73b609-4b12-4d76-be37-ad0bcba66df0", + "value": "32419" + }, + { + "description": "Petroleum Lubricating Oil and Grease Manufacturing ", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5422c79c-17b3-4594-aded-7a7caa9308af", + "value": "324191" + }, + { + "description": "All Other Petroleum and Coal Products Manufacturing ", + "related": [ + { + "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "054c625f-721e-4233-a916-056759ce0305", + "value": "324199" + }, + { + "description": "Chemical Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "19702970-49c2-42eb-97de-129e10c653d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "value": "325" + }, + { + "description": "Basic Chemical Manufacturing", + "related": [ + { + "dest-uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "489a7b0f-aebf-412c-8dda-bb97770b7186", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "57d8e594-cdb4-4542-a866-f721e4bea141", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "342b71f6-48cb-47c0-a35b-c84d791fcd8d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d8334476-986d-4d3a-b3f0-8ffa99df845d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fe6ec7ae-1ce9-4f06-abdc-9a795a12b2bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b1791d92-c907-4296-9615-22d6296d33c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2e9461a7-2b60-4104-920f-74a4f5559f5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "005248a6-d042-41a4-b62c-68b1612514b5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "030c02eb-ae02-4878-96a2-00323035b214", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "79357c3d-0b98-444f-8892-b036d1017ce4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3aac9cdf-794a-4131-b01c-66f2c89db541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ac332838-f541-42e1-890b-dcb8b62c7ec9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "value": "3251" + }, + { + "description": "Petrochemical Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "57d8e594-cdb4-4542-a866-f721e4bea141", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "489a7b0f-aebf-412c-8dda-bb97770b7186", + "value": "32511" + }, + { + "description": "Petrochemical Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "489a7b0f-aebf-412c-8dda-bb97770b7186", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "57d8e594-cdb4-4542-a866-f721e4bea141", + "value": "325110" + }, + { + "description": "Industrial Gas Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d8334476-986d-4d3a-b3f0-8ffa99df845d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "342b71f6-48cb-47c0-a35b-c84d791fcd8d", + "value": "32512" + }, + { + "description": "Industrial Gas Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "342b71f6-48cb-47c0-a35b-c84d791fcd8d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d8334476-986d-4d3a-b3f0-8ffa99df845d", + "value": "325120" + }, + { + "description": "Synthetic Dye and Pigment Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b1791d92-c907-4296-9615-22d6296d33c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fe6ec7ae-1ce9-4f06-abdc-9a795a12b2bf", + "value": "32513" + }, + { + "description": "Synthetic Dye and Pigment Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fe6ec7ae-1ce9-4f06-abdc-9a795a12b2bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b1791d92-c907-4296-9615-22d6296d33c4", + "value": "325130" + }, + { + "description": "Other Basic Inorganic Chemical Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "005248a6-d042-41a4-b62c-68b1612514b5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2e9461a7-2b60-4104-920f-74a4f5559f5d", + "value": "32518" + }, + { + "description": "Other Basic Inorganic Chemical Manufacturing ", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2e9461a7-2b60-4104-920f-74a4f5559f5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "005248a6-d042-41a4-b62c-68b1612514b5", + "value": "325180" + }, + { + "description": "Other Basic Organic Chemical Manufacturing", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "030c02eb-ae02-4878-96a2-00323035b214", + "value": "32519" + }, + { + "description": "Ethyl Alcohol Manufacturing ", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "79357c3d-0b98-444f-8892-b036d1017ce4", + "value": "325193" + }, + { + "description": "Cyclic Crude, Intermediate, and Gum and Wood Chemical Manufacturing ", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3aac9cdf-794a-4131-b01c-66f2c89db541", + "value": "325194" + }, + { + "description": "All Other Basic Organic Chemical Manufacturing ", + "related": [ + { + "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ac332838-f541-42e1-890b-dcb8b62c7ec9", + "value": "325199" + }, + { + "description": "Resin, Synthetic Rubber, and Artificial and Synthetic Fibers and Filaments Manufacturing", + "related": [ + { + "dest-uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6d334d99-10e6-418d-a303-c6b07d26bb3e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f962c0a2-9dfb-4f39-935e-35745ab88ebe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "63dc1d21-0c62-45c3-9dd7-8939d7456f8b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2eb31dd8-54f6-48eb-9976-a8aa9d543d34", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "44e983a9-b004-4d38-89dd-ac50b937cf03", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", + "value": "3252" + }, + { + "description": "Resin and Synthetic Rubber Manufacturing", + "related": [ + { + "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6d334d99-10e6-418d-a303-c6b07d26bb3e", + "value": "32521" + }, + { + "description": "Plastics Material and Resin Manufacturing ", + "related": [ + { + "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f962c0a2-9dfb-4f39-935e-35745ab88ebe", + "value": "325211" + }, + { + "description": "Synthetic Rubber Manufacturing ", + "related": [ + { + "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "63dc1d21-0c62-45c3-9dd7-8939d7456f8b", + "value": "325212" + }, + { + "description": "Artificial and Synthetic Fibers and Filaments Manufacturing", + "related": [ + { + "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "44e983a9-b004-4d38-89dd-ac50b937cf03", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2eb31dd8-54f6-48eb-9976-a8aa9d543d34", + "value": "32522" + }, + { + "description": "Artificial and Synthetic Fibers and Filaments Manufacturing", + "related": [ + { + "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2eb31dd8-54f6-48eb-9976-a8aa9d543d34", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "44e983a9-b004-4d38-89dd-ac50b937cf03", + "value": "325220" + }, + { + "description": "Pesticide, Fertilizer, and Other Agricultural Chemical Manufacturing", + "related": [ + { + "dest-uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "309cd279-1853-49ff-bcff-d4671df682ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b394c7f8-5888-45a2-84dc-48ff34842e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "47a4bdf0-0a42-4fb3-823b-7d31a8066281", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4dec9bbf-c046-412b-aa96-c9395cecd40b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bca094d7-bed2-4428-92cf-00a55e55c7c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cf8b2062-9186-4c00-a3f8-a36361392aa4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d96134d9-065f-48bc-a3b5-49b75f85764f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "value": "3253" + }, + { + "description": "Fertilizer and Compost Manufacturing", + "related": [ + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "309cd279-1853-49ff-bcff-d4671df682ff", + "value": "32531" + }, + { + "description": "Nitrogenous Fertilizer Manufacturing ", + "related": [ + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b394c7f8-5888-45a2-84dc-48ff34842e6f", + "value": "325311" + }, + { + "description": "Phosphatic Fertilizer Manufacturing ", + "related": [ + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "47a4bdf0-0a42-4fb3-823b-7d31a8066281", + "value": "325312" + }, + { + "description": "Fertilizer (Mixing Only) Manufacturing ", + "related": [ + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4dec9bbf-c046-412b-aa96-c9395cecd40b", + "value": "325314" + }, + { + "description": "Compost Manufacturing", + "related": [ + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bca094d7-bed2-4428-92cf-00a55e55c7c4", + "value": "325315" + }, + { + "description": "Pesticide and Other Agricultural Chemical Manufacturing", + "related": [ + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d96134d9-065f-48bc-a3b5-49b75f85764f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cf8b2062-9186-4c00-a3f8-a36361392aa4", + "value": "32532" + }, + { + "description": "Pesticide and Other Agricultural Chemical Manufacturing", + "related": [ + { + "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cf8b2062-9186-4c00-a3f8-a36361392aa4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d96134d9-065f-48bc-a3b5-49b75f85764f", + "value": "325320" + }, + { + "description": "Pharmaceutical and Medicine Manufacturing", + "related": [ + { + "dest-uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7a0dca87-4070-4443-9695-45fbfbf357ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "638c438b-0ec1-4736-b6b6-8fcf531abe5b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0b014ca6-5af8-43b9-a227-969519869653", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "430e8b8b-1fdf-4956-b801-df21ade022ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aa7432a1-1377-4c91-b225-f1cf14dbfa44", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", + "value": "3254" + }, + { + "description": "Pharmaceutical and Medicine Manufacturing", + "related": [ + { + "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7a0dca87-4070-4443-9695-45fbfbf357ab", + "value": "32541" + }, + { + "description": "Medicinal and Botanical Manufacturing ", + "related": [ + { + "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "638c438b-0ec1-4736-b6b6-8fcf531abe5b", + "value": "325411" + }, + { + "description": "Pharmaceutical Preparation Manufacturing ", + "related": [ + { + "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0b014ca6-5af8-43b9-a227-969519869653", + "value": "325412" + }, + { + "description": "In-Vitro Diagnostic Substance Manufacturing ", + "related": [ + { + "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "430e8b8b-1fdf-4956-b801-df21ade022ad", + "value": "325413" + }, + { + "description": "Biological Product (except Diagnostic) Manufacturing ", + "related": [ + { + "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "aa7432a1-1377-4c91-b225-f1cf14dbfa44", + "value": "325414" + }, + { + "description": "Paint, Coating, and Adhesive Manufacturing", + "related": [ + { + "dest-uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "41d8a6ed-c1fe-45e4-812a-dbc3badb37eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0009f0e2-4531-4231-986c-fef4e6a4d070", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9824bc17-9d22-4fa6-8d9f-0549f5805132", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "913c1207-6b59-4b91-82a1-ca0653a68a14", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "19702970-49c2-42eb-97de-129e10c653d0", + "value": "3255" + }, + { + "description": "Paint and Coating Manufacturing", + "related": [ + { + "dest-uuid": "19702970-49c2-42eb-97de-129e10c653d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0009f0e2-4531-4231-986c-fef4e6a4d070", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "41d8a6ed-c1fe-45e4-812a-dbc3badb37eb", + "value": "32551" + }, + { + "description": "Paint and Coating Manufacturing", + "related": [ + { + "dest-uuid": "19702970-49c2-42eb-97de-129e10c653d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "41d8a6ed-c1fe-45e4-812a-dbc3badb37eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0009f0e2-4531-4231-986c-fef4e6a4d070", + "value": "325510" + }, + { + "description": "Adhesive Manufacturing", + "related": [ + { + "dest-uuid": "19702970-49c2-42eb-97de-129e10c653d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "913c1207-6b59-4b91-82a1-ca0653a68a14", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9824bc17-9d22-4fa6-8d9f-0549f5805132", + "value": "32552" + }, + { + "description": "Adhesive Manufacturing", + "related": [ + { + "dest-uuid": "19702970-49c2-42eb-97de-129e10c653d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9824bc17-9d22-4fa6-8d9f-0549f5805132", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "913c1207-6b59-4b91-82a1-ca0653a68a14", + "value": "325520" + }, + { + "description": "Soap, Cleaning Compound, and Toilet Preparation Manufacturing", + "related": [ + { + "dest-uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "16cd1b4c-80e5-4bad-9d56-8fe8a4198f35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4f51dbe1-3462-45af-a528-66464bed97b8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "29393a2d-8e8a-4c00-a461-66ae10ebf2cb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "29f767fa-0da4-4a7b-bf62-6504ad6286cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4f09893d-e213-4242-897f-812231a4faba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4ab46c08-bef6-4a37-9f15-43c1407c8686", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "value": "3256" + }, + { + "description": "Soap and Cleaning Compound Manufacturing", + "related": [ + { + "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "16cd1b4c-80e5-4bad-9d56-8fe8a4198f35", + "value": "32561" + }, + { + "description": "Soap and Other Detergent Manufacturing ", + "related": [ + { + "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4f51dbe1-3462-45af-a528-66464bed97b8", + "value": "325611" + }, + { + "description": "Polish and Other Sanitation Good Manufacturing ", + "related": [ + { + "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "29393a2d-8e8a-4c00-a461-66ae10ebf2cb", + "value": "325612" + }, + { + "description": "Surface Active Agent Manufacturing ", + "related": [ + { + "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "29f767fa-0da4-4a7b-bf62-6504ad6286cc", + "value": "325613" + }, + { + "description": "Toilet Preparation Manufacturing", + "related": [ + { + "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4ab46c08-bef6-4a37-9f15-43c1407c8686", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4f09893d-e213-4242-897f-812231a4faba", + "value": "32562" + }, + { + "description": "Toilet Preparation Manufacturing", + "related": [ + { + "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4f09893d-e213-4242-897f-812231a4faba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4ab46c08-bef6-4a37-9f15-43c1407c8686", + "value": "325620" + }, + { + "description": "Other Chemical Product and Preparation Manufacturing", + "related": [ + { + "dest-uuid": "0d082134-97b1-4299-b821-d61f7ee33541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "847295db-14a6-4e94-ae44-4313716d278c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5a29a5d2-c757-4af8-aea9-ead21ea86c88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4aa820ed-24ec-45a5-8af4-e05bb65a40a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f2f24d53-bb35-4f45-b6c1-d9684661b27c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "86c53a4e-d50f-450e-ae83-2d952347c8f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6fc8ccf8-70cb-4cb2-af32-d69666e36654", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9bb7d81e-ed89-4533-8d74-f12cf9e26c61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e0b08cbe-f98a-4c26-acaf-82ecd8518ab3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "value": "3259" + }, + { + "description": "Printing Ink Manufacturing", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5a29a5d2-c757-4af8-aea9-ead21ea86c88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "847295db-14a6-4e94-ae44-4313716d278c", + "value": "32591" + }, + { + "description": "Printing Ink Manufacturing", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "847295db-14a6-4e94-ae44-4313716d278c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5a29a5d2-c757-4af8-aea9-ead21ea86c88", + "value": "325910" + }, + { + "description": "Explosives Manufacturing", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f2f24d53-bb35-4f45-b6c1-d9684661b27c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4aa820ed-24ec-45a5-8af4-e05bb65a40a6", + "value": "32592" + }, + { + "description": "Explosives Manufacturing", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4aa820ed-24ec-45a5-8af4-e05bb65a40a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f2f24d53-bb35-4f45-b6c1-d9684661b27c", + "value": "325920" + }, + { + "description": "All Other Chemical Product and Preparation Manufacturing", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "86c53a4e-d50f-450e-ae83-2d952347c8f4", + "value": "32599" + }, + { + "description": "Custom Compounding of Purchased Resins ", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6fc8ccf8-70cb-4cb2-af32-d69666e36654", + "value": "325991" + }, + { + "description": "Photographic Film, Paper, Plate, Chemical, and Copy Toner Manufacturing ", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9bb7d81e-ed89-4533-8d74-f12cf9e26c61", + "value": "325992" + }, + { + "description": "All Other Miscellaneous Chemical Product and Preparation Manufacturing ", + "related": [ + { + "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e0b08cbe-f98a-4c26-acaf-82ecd8518ab3", + "value": "325998" + }, + { + "description": "Plastics and Rubber Products Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d4d5aedf-0253-46f8-af60-dcff41696e9f", + "value": "326" + }, + { + "description": "Plastics Product Manufacturing", + "related": [ + { + "dest-uuid": "d4d5aedf-0253-46f8-af60-dcff41696e9f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0c977c88-8042-4785-9c7d-38c569c5e2f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eaa0b751-3643-4e64-944c-48425a93c0f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "46b717a7-4871-41a9-8fc6-5923b2eaffed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0eb3f6c7-3093-43e3-8feb-69356c735c20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b078525a-3781-4235-bc25-5343bb97bffd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "613fa1c3-14a4-46a7-ba82-28b1fe6f7e2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3273cd13-51b6-4cf1-a51d-29c8233c1fed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d915e232-3351-4e2c-a9b0-add3cbfd6f34", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0408ce71-a38c-486b-ba52-da90a7e1d580", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7ae623ea-224d-41e5-a504-b978f03cc05d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2ccac3d4-4a13-463b-9eae-3ed42b3350bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b1d46a68-3cf3-4d6a-b8ab-f4a16585bf9f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "82e04eec-ea7b-44e2-8f19-a31e6bda2583", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "96c5aa38-03d8-4428-97c6-8f846f3b43ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d812f916-cef9-4c09-aaf4-9b9e6cf5725b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5d72ba3f-dbf0-46f3-a5d1-4522ed93f82a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "19b8b556-cafc-4baa-83c2-20b71b12cc59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "90e09397-37f7-4bb7-b1f2-6b8a639f2941", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "value": "3261" + }, + { + "description": "Plastics Packaging Materials and Unlaminated Film and Sheet Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0c977c88-8042-4785-9c7d-38c569c5e2f8", + "value": "32611" + }, + { + "description": "Plastics Bag and Pouch Manufacturing ", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "eaa0b751-3643-4e64-944c-48425a93c0f7", + "value": "326111" + }, + { + "description": "Plastics Packaging Film and Sheet (including Laminated) Manufacturing ", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "46b717a7-4871-41a9-8fc6-5923b2eaffed", + "value": "326112" + }, + { + "description": "Unlaminated Plastics Film and Sheet (except Packaging) Manufacturing ", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0eb3f6c7-3093-43e3-8feb-69356c735c20", + "value": "326113" + }, + { + "description": "Plastics Pipe, Pipe Fitting, and Unlaminated Profile Shape Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b078525a-3781-4235-bc25-5343bb97bffd", + "value": "32612" + }, + { + "description": "Unlaminated Plastics Profile Shape Manufacturing ", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "613fa1c3-14a4-46a7-ba82-28b1fe6f7e2b", + "value": "326121" + }, + { + "description": "Plastics Pipe and Pipe Fitting Manufacturing ", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3273cd13-51b6-4cf1-a51d-29c8233c1fed", + "value": "326122" + }, + { + "description": "Laminated Plastics Plate, Sheet (except Packaging), and Shape Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0408ce71-a38c-486b-ba52-da90a7e1d580", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d915e232-3351-4e2c-a9b0-add3cbfd6f34", + "value": "32613" + }, + { + "description": "Laminated Plastics Plate, Sheet (except Packaging), and Shape Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d915e232-3351-4e2c-a9b0-add3cbfd6f34", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0408ce71-a38c-486b-ba52-da90a7e1d580", + "value": "326130" + }, + { + "description": "Polystyrene Foam Product Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2ccac3d4-4a13-463b-9eae-3ed42b3350bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7ae623ea-224d-41e5-a504-b978f03cc05d", + "value": "32614" + }, + { + "description": "Polystyrene Foam Product Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7ae623ea-224d-41e5-a504-b978f03cc05d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2ccac3d4-4a13-463b-9eae-3ed42b3350bb", + "value": "326140" + }, + { + "description": "Urethane and Other Foam Product (except Polystyrene) Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "82e04eec-ea7b-44e2-8f19-a31e6bda2583", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b1d46a68-3cf3-4d6a-b8ab-f4a16585bf9f", + "value": "32615" + }, + { + "description": "Urethane and Other Foam Product (except Polystyrene) Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b1d46a68-3cf3-4d6a-b8ab-f4a16585bf9f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "82e04eec-ea7b-44e2-8f19-a31e6bda2583", + "value": "326150" + }, + { + "description": "Plastics Bottle Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d812f916-cef9-4c09-aaf4-9b9e6cf5725b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "96c5aa38-03d8-4428-97c6-8f846f3b43ca", + "value": "32616" + }, + { + "description": "Plastics Bottle Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "96c5aa38-03d8-4428-97c6-8f846f3b43ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d812f916-cef9-4c09-aaf4-9b9e6cf5725b", + "value": "326160" + }, + { + "description": "Other Plastics Product Manufacturing", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5d72ba3f-dbf0-46f3-a5d1-4522ed93f82a", + "value": "32619" + }, + { + "description": "Plastics Plumbing Fixture Manufacturing ", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "19b8b556-cafc-4baa-83c2-20b71b12cc59", + "value": "326191" + }, + { + "description": "All Other Plastics Product Manufacturing ", + "related": [ + { + "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "90e09397-37f7-4bb7-b1f2-6b8a639f2941", + "value": "326199" + }, + { + "description": "Rubber Product Manufacturing", + "related": [ + { + "dest-uuid": "d4d5aedf-0253-46f8-af60-dcff41696e9f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9c83a88f-307c-43d3-a132-c9fefd62d401", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bcc71803-af84-4110-93bb-cc792d377fac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "45a85e22-1cd0-4376-9de8-f548d31664db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ae655b22-5bff-41f0-8725-5979e724e318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4ad63168-4920-4f84-8b31-55d7cba5ce15", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "da5406a8-1834-4491-8866-8c341b7996f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "83ec2510-f4ee-4e55-bd72-11c741e58179", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6f0638f9-b2a8-4146-b8fd-d75f7672a7c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "value": "3262" + }, + { + "description": "Tire Manufacturing", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9c83a88f-307c-43d3-a132-c9fefd62d401", + "value": "32621" + }, + { + "description": "Tire Manufacturing (except Retreading) ", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bcc71803-af84-4110-93bb-cc792d377fac", + "value": "326211" + }, + { + "description": "Tire Retreading ", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "45a85e22-1cd0-4376-9de8-f548d31664db", + "value": "326212" + }, + { + "description": "Rubber and Plastics Hoses and Belting Manufacturing", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4ad63168-4920-4f84-8b31-55d7cba5ce15", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ae655b22-5bff-41f0-8725-5979e724e318", + "value": "32622" + }, + { + "description": "Rubber and Plastics Hoses and Belting Manufacturing", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ae655b22-5bff-41f0-8725-5979e724e318", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4ad63168-4920-4f84-8b31-55d7cba5ce15", + "value": "326220" + }, + { + "description": "Other Rubber Product Manufacturing", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "da5406a8-1834-4491-8866-8c341b7996f9", + "value": "32629" + }, + { + "description": "Rubber Product Manufacturing for Mechanical Use ", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "83ec2510-f4ee-4e55-bd72-11c741e58179", + "value": "326291" + }, + { + "description": "All Other Rubber Product Manufacturing ", + "related": [ + { + "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6f0638f9-b2a8-4146-b8fd-d75f7672a7c2", + "value": "326299" + }, + { + "description": "Nonmetallic Mineral Product Manufacturing", + "related": [ + { + "dest-uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b7f9c8b7-7297-40c0-8f92-5b5422139cdc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f8dd4bac-8e94-412e-8797-fc668f22c639", + "value": "327" + }, + { + "description": "Clay Product and Refractory Manufacturing", + "related": [ + { + "dest-uuid": "f8dd4bac-8e94-412e-8797-fc668f22c639", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a57a5284-b9f5-471d-91a1-f88afca1309d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "27dcc4de-0049-4a95-8017-caa64c392240", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "86b81480-7c14-4c8e-9f5a-916d6cf04bf7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fe13ddd8-b76d-492a-ae11-439858941b1d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", + "value": "3271" + }, + { + "description": "Pottery, Ceramics, and Plumbing Fixture Manufacturing", + "related": [ + { + "dest-uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "27dcc4de-0049-4a95-8017-caa64c392240", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a57a5284-b9f5-471d-91a1-f88afca1309d", + "value": "32711" + }, + { + "description": "Pottery, Ceramics, and Plumbing Fixture Manufacturing ", + "related": [ + { + "dest-uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a57a5284-b9f5-471d-91a1-f88afca1309d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "27dcc4de-0049-4a95-8017-caa64c392240", + "value": "327110" + }, + { + "description": "Clay Building Material and Refractories Manufacturing", + "related": [ + { + "dest-uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fe13ddd8-b76d-492a-ae11-439858941b1d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "86b81480-7c14-4c8e-9f5a-916d6cf04bf7", + "value": "32712" + }, + { + "description": "Clay Building Material and Refractories Manufacturing ", + "related": [ + { + "dest-uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "86b81480-7c14-4c8e-9f5a-916d6cf04bf7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fe13ddd8-b76d-492a-ae11-439858941b1d", + "value": "327120" + }, + { + "description": "Glass and Glass Product Manufacturing", + "related": [ + { + "dest-uuid": "f8dd4bac-8e94-412e-8797-fc668f22c639", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "30b6b806-d47d-40f7-a440-617dfb7266e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "876463a0-24e1-40d1-b14c-6df880fa43bc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f3fbc221-3a8a-4fdf-bfd2-07088a2ea3c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9476e8b1-7f45-4a91-823d-d4cd9f67fcf8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "62a581a1-b357-402a-8a41-dc7f318b9f1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", + "value": "3272" + }, + { + "description": "Glass and Glass Product Manufacturing", + "related": [ + { + "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "30b6b806-d47d-40f7-a440-617dfb7266e7", + "value": "32721" + }, + { + "description": "Flat Glass Manufacturing ", + "related": [ + { + "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "876463a0-24e1-40d1-b14c-6df880fa43bc", + "value": "327211" + }, + { + "description": "Other Pressed and Blown Glass and Glassware Manufacturing ", + "related": [ + { + "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f3fbc221-3a8a-4fdf-bfd2-07088a2ea3c4", + "value": "327212" + }, + { + "description": "Glass Container Manufacturing ", + "related": [ + { + "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9476e8b1-7f45-4a91-823d-d4cd9f67fcf8", + "value": "327213" + }, + { + "description": "Glass Product Manufacturing Made of Purchased Glass ", + "related": [ + { + "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "62a581a1-b357-402a-8a41-dc7f318b9f1c", + "value": "327215" + }, + { + "description": "Cement and Concrete Product Manufacturing", + "related": [ + { + "dest-uuid": "f8dd4bac-8e94-412e-8797-fc668f22c639", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "20f1ae24-98ac-469d-b35c-64840896981d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ed2b6a68-9069-4b89-86a8-1b4fbf95eebb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4a6f41b7-9b0f-43c9-829c-44f75fb97a41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e7e18a17-a34d-47f0-8e37-8f753eeb4715", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f3ec14c6-cce8-4372-9774-716fa5078de4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a0640252-a3d6-4e64-8682-0a77e98cb704", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f2e19c09-ec3a-4458-bdc3-73d5cb66e0ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "96f523ee-a225-4773-ab8f-079a8ecbc934", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "798218d7-f524-4f2b-8e3e-762bea65bfa6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "value": "3273" + }, + { + "description": "Cement Manufacturing", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ed2b6a68-9069-4b89-86a8-1b4fbf95eebb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "20f1ae24-98ac-469d-b35c-64840896981d", + "value": "32731" + }, + { + "description": "Cement Manufacturing", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "20f1ae24-98ac-469d-b35c-64840896981d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ed2b6a68-9069-4b89-86a8-1b4fbf95eebb", + "value": "327310" + }, + { + "description": "Ready-Mix Concrete Manufacturing", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e7e18a17-a34d-47f0-8e37-8f753eeb4715", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4a6f41b7-9b0f-43c9-829c-44f75fb97a41", + "value": "32732" + }, + { + "description": "Ready-Mix Concrete Manufacturing", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4a6f41b7-9b0f-43c9-829c-44f75fb97a41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e7e18a17-a34d-47f0-8e37-8f753eeb4715", + "value": "327320" + }, + { + "description": "Concrete Pipe, Brick, and Block Manufacturing", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f3ec14c6-cce8-4372-9774-716fa5078de4", + "value": "32733" + }, + { + "description": "Concrete Block and Brick Manufacturing ", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a0640252-a3d6-4e64-8682-0a77e98cb704", + "value": "327331" + }, + { + "description": "Concrete Pipe Manufacturing ", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f2e19c09-ec3a-4458-bdc3-73d5cb66e0ca", + "value": "327332" + }, + { + "description": "Other Concrete Product Manufacturing", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "798218d7-f524-4f2b-8e3e-762bea65bfa6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "96f523ee-a225-4773-ab8f-079a8ecbc934", + "value": "32739" + }, + { + "description": "Other Concrete Product Manufacturing ", + "related": [ + { + "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "96f523ee-a225-4773-ab8f-079a8ecbc934", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "798218d7-f524-4f2b-8e3e-762bea65bfa6", + "value": "327390" + }, + { + "description": "Lime and Gypsum Product Manufacturing", + "related": [ + { + "dest-uuid": "f8dd4bac-8e94-412e-8797-fc668f22c639", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "82588d76-65e8-41cd-ab5f-a00278d04266", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "534f2b5b-d3dd-4df4-b81a-a1fbc2777aa3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c4a40847-ef18-4af2-80bb-9df71beb7c5f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5eff0f0a-b128-42f1-8f4c-637a0eff74e0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b7f9c8b7-7297-40c0-8f92-5b5422139cdc", + "value": "3274" + }, + { + "description": "Lime Manufacturing", + "related": [ + { + "dest-uuid": "b7f9c8b7-7297-40c0-8f92-5b5422139cdc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "534f2b5b-d3dd-4df4-b81a-a1fbc2777aa3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "82588d76-65e8-41cd-ab5f-a00278d04266", + "value": "32741" + }, + { + "description": "Lime Manufacturing", + "related": [ + { + "dest-uuid": "b7f9c8b7-7297-40c0-8f92-5b5422139cdc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "82588d76-65e8-41cd-ab5f-a00278d04266", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "534f2b5b-d3dd-4df4-b81a-a1fbc2777aa3", + "value": "327410" + }, + { + "description": "Gypsum Product Manufacturing", + "related": [ + { + "dest-uuid": "b7f9c8b7-7297-40c0-8f92-5b5422139cdc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5eff0f0a-b128-42f1-8f4c-637a0eff74e0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c4a40847-ef18-4af2-80bb-9df71beb7c5f", + "value": "32742" + }, + { + "description": "Gypsum Product Manufacturing", + "related": [ + { + "dest-uuid": "b7f9c8b7-7297-40c0-8f92-5b5422139cdc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c4a40847-ef18-4af2-80bb-9df71beb7c5f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5eff0f0a-b128-42f1-8f4c-637a0eff74e0", + "value": "327420" + }, + { + "description": "Other Nonmetallic Mineral Product Manufacturing", + "related": [ + { + "dest-uuid": "f8dd4bac-8e94-412e-8797-fc668f22c639", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d625eb8c-4343-414b-b786-bbb7d5188731", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5a379eb5-67cd-4da0-af26-191f72418f72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a8e894f-a38f-47c4-a6f1-e48d5388353a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f1d4ef8e-4d0e-40fd-af30-3fa603f4a129", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3a9caa37-a9e6-4a02-b44c-68b5cd286308", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d99129f-a5fc-4001-bccc-ee7faae153ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "16dbcda5-81e8-4b5b-a766-1d95197c3cf8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "value": "3279" + }, + { + "description": "Abrasive Product Manufacturing", + "related": [ + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5a379eb5-67cd-4da0-af26-191f72418f72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d625eb8c-4343-414b-b786-bbb7d5188731", + "value": "32791" + }, + { + "description": "Abrasive Product Manufacturing", + "related": [ + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d625eb8c-4343-414b-b786-bbb7d5188731", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5a379eb5-67cd-4da0-af26-191f72418f72", + "value": "327910" + }, + { + "description": "All Other Nonmetallic Mineral Product Manufacturing", + "related": [ + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8a8e894f-a38f-47c4-a6f1-e48d5388353a", + "value": "32799" + }, + { + "description": "Cut Stone and Stone Product Manufacturing ", + "related": [ + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f1d4ef8e-4d0e-40fd-af30-3fa603f4a129", + "value": "327991" + }, + { + "description": "Ground or Treated Mineral and Earth Manufacturing ", + "related": [ + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3a9caa37-a9e6-4a02-b44c-68b5cd286308", + "value": "327992" + }, + { + "description": "Mineral Wool Manufacturing ", + "related": [ + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7d99129f-a5fc-4001-bccc-ee7faae153ac", + "value": "327993" + }, + { + "description": "All Other Miscellaneous Nonmetallic Mineral Product Manufacturing ", + "related": [ + { + "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "16dbcda5-81e8-4b5b-a766-1d95197c3cf8", + "value": "327999" + }, + { + "description": "Primary Metal Manufacturing", + "related": [ + { + "dest-uuid": "4a48a8c9-f378-449b-9d06-f921f8a75726", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6b32ae32-98fa-4de8-9965-d2f845d3ed66", + "value": "331" + }, + { + "description": "Iron and Steel Mills and Ferroalloy Manufacturing", + "related": [ + { + "dest-uuid": "6b32ae32-98fa-4de8-9965-d2f845d3ed66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "004faeb7-16b6-4a42-8829-530305207788", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3a22a461-3421-4c1c-ae3b-85cd2e7ad35e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4a48a8c9-f378-449b-9d06-f921f8a75726", + "value": "3311" + }, + { + "description": "Iron and Steel Mills and Ferroalloy Manufacturing", + "related": [ + { + "dest-uuid": "4a48a8c9-f378-449b-9d06-f921f8a75726", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a22a461-3421-4c1c-ae3b-85cd2e7ad35e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "004faeb7-16b6-4a42-8829-530305207788", + "value": "33111" + }, + { + "description": "Iron and Steel Mills and Ferroalloy Manufacturing ", + "related": [ + { + "dest-uuid": "4a48a8c9-f378-449b-9d06-f921f8a75726", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "004faeb7-16b6-4a42-8829-530305207788", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3a22a461-3421-4c1c-ae3b-85cd2e7ad35e", + "value": "331110" + }, + { + "description": "Steel Product Manufacturing from Purchased Steel", + "related": [ + { + "dest-uuid": "6b32ae32-98fa-4de8-9965-d2f845d3ed66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4fe644a8-5e44-459f-b48b-87fd96cb30d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1b6c2e81-b6ba-4819-a94b-1160ae1d8c9c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d7b95958-52e1-4b25-9ee5-67b099baf924", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d8b9eb92-e85a-4838-8083-80cfe7fb9334", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d3d53c0a-5436-463a-8096-0d34c7e2a88d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", + "value": "3312" + }, + { + "description": "Iron and Steel Pipe and Tube Manufacturing from Purchased Steel", + "related": [ + { + "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1b6c2e81-b6ba-4819-a94b-1160ae1d8c9c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4fe644a8-5e44-459f-b48b-87fd96cb30d5", + "value": "33121" + }, + { + "description": "Iron and Steel Pipe and Tube Manufacturing from Purchased Steel", + "related": [ + { + "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4fe644a8-5e44-459f-b48b-87fd96cb30d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1b6c2e81-b6ba-4819-a94b-1160ae1d8c9c", + "value": "331210" + }, + { + "description": "Rolling and Drawing of Purchased Steel", + "related": [ + { + "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d7b95958-52e1-4b25-9ee5-67b099baf924", + "value": "33122" + }, + { + "description": "Rolled Steel Shape Manufacturing ", + "related": [ + { + "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d8b9eb92-e85a-4838-8083-80cfe7fb9334", + "value": "331221" + }, + { + "description": "Steel Wire Drawing ", + "related": [ + { + "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d3d53c0a-5436-463a-8096-0d34c7e2a88d", + "value": "331222" + }, + { + "description": "Alumina and Aluminum Production and Processing", + "related": [ + { + "dest-uuid": "6b32ae32-98fa-4de8-9965-d2f845d3ed66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b272279-6e90-41d5-bcaa-77412bfa4c36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b9f052a9-5757-4571-9419-22ed6fdbab77", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0d10cb6d-a8c8-47d1-870e-d6f124a22ed3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2974d502-b246-4b2d-9d85-28a8872b511c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "683ef38e-3c1d-47a6-9ccc-abec6f63d703", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", + "value": "3313" + }, + { + "description": "Alumina and Aluminum Production and Processing", + "related": [ + { + "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2b272279-6e90-41d5-bcaa-77412bfa4c36", + "value": "33131" + }, + { + "description": "Alumina Refining and Primary Aluminum Production ", + "related": [ + { + "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b9f052a9-5757-4571-9419-22ed6fdbab77", + "value": "331313" + }, + { + "description": "Secondary Smelting and Alloying of Aluminum ", + "related": [ + { + "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0d10cb6d-a8c8-47d1-870e-d6f124a22ed3", + "value": "331314" + }, + { + "description": "Aluminum Sheet, Plate, and Foil Manufacturing ", + "related": [ + { + "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2974d502-b246-4b2d-9d85-28a8872b511c", + "value": "331315" + }, + { + "description": "Other Aluminum Rolling, Drawing, and Extruding ", + "related": [ + { + "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "683ef38e-3c1d-47a6-9ccc-abec6f63d703", + "value": "331318" + }, + { + "description": "Nonferrous Metal (except Aluminum) Production and Processing", + "related": [ + { + "dest-uuid": "6b32ae32-98fa-4de8-9965-d2f845d3ed66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1fa66f2e-0190-4fdc-9a82-83853df87901", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1af8c1c4-de0f-4609-9108-49a38a2caff2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f1c0d52a-28b2-4b10-aad7-0ad56f933db4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4fde0ce6-eab7-4d44-bd1d-fb38fa9912db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0244cf5e-c8dc-4322-9db9-edafc7abd522", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f106ea98-ed01-4fa6-9bc7-184837328dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "47e64653-841d-43b7-8c02-c167a3e2839a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "value": "3314" + }, + { + "description": "Nonferrous Metal (except Aluminum) Smelting and Refining", + "related": [ + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1af8c1c4-de0f-4609-9108-49a38a2caff2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1fa66f2e-0190-4fdc-9a82-83853df87901", + "value": "33141" + }, + { + "description": "Nonferrous Metal (except Aluminum) Smelting and Refining ", + "related": [ + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1fa66f2e-0190-4fdc-9a82-83853df87901", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1af8c1c4-de0f-4609-9108-49a38a2caff2", + "value": "331410" + }, + { + "description": "Copper Rolling, Drawing, Extruding, and Alloying", + "related": [ + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4fde0ce6-eab7-4d44-bd1d-fb38fa9912db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f1c0d52a-28b2-4b10-aad7-0ad56f933db4", + "value": "33142" + }, + { + "description": "Copper Rolling, Drawing, Extruding, and Alloying", + "related": [ + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f1c0d52a-28b2-4b10-aad7-0ad56f933db4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4fde0ce6-eab7-4d44-bd1d-fb38fa9912db", + "value": "331420" + }, + { + "description": "Nonferrous Metal (except Copper and Aluminum) Rolling, Drawing, Extruding, and Alloying", + "related": [ + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0244cf5e-c8dc-4322-9db9-edafc7abd522", + "value": "33149" + }, + { + "description": "Nonferrous Metal (except Copper and Aluminum) Rolling, Drawing, and Extruding ", + "related": [ + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f106ea98-ed01-4fa6-9bc7-184837328dc1", + "value": "331491" + }, + { + "description": "Secondary Smelting, Refining, and Alloying of Nonferrous Metal (except Copper and Aluminum) ", + "related": [ + { + "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "47e64653-841d-43b7-8c02-c167a3e2839a", + "value": "331492" + }, + { + "description": "Foundries", + "related": [ + { + "dest-uuid": "6b32ae32-98fa-4de8-9965-d2f845d3ed66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9848516a-b2ba-4961-a5bb-2f93c805ae81", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d09f5f45-6cbd-4826-a2f5-14e0a65dff5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aabb6758-b302-4d2c-bd19-077f68749a3a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "833fd00b-97ec-4ca2-81cf-d8e4bd3fc52b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4360af13-d182-4353-b016-33c3f03c4607", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "66d1b7d0-78b9-4f2b-b06c-ed14f85f2acb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2a07eb0d-d58b-4081-b023-df1895aa9204", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c601fad4-d0f2-4e8d-90cd-877a3e91d928", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "value": "3315" + }, + { + "description": "Ferrous Metal Foundries", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9848516a-b2ba-4961-a5bb-2f93c805ae81", + "value": "33151" + }, + { + "description": "Iron Foundries ", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d09f5f45-6cbd-4826-a2f5-14e0a65dff5d", + "value": "331511" + }, + { + "description": "Steel Investment Foundries ", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "aabb6758-b302-4d2c-bd19-077f68749a3a", + "value": "331512" + }, + { + "description": "Steel Foundries (except Investment) ", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "833fd00b-97ec-4ca2-81cf-d8e4bd3fc52b", + "value": "331513" + }, + { + "description": "Nonferrous Metal Foundries", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4360af13-d182-4353-b016-33c3f03c4607", + "value": "33152" + }, + { + "description": "Nonferrous Metal Die-Casting Foundries ", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "66d1b7d0-78b9-4f2b-b06c-ed14f85f2acb", + "value": "331523" + }, + { + "description": "Aluminum Foundries (except Die-Casting) ", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2a07eb0d-d58b-4081-b023-df1895aa9204", + "value": "331524" + }, + { + "description": "Other Nonferrous Metal Foundries (except Die-Casting) ", + "related": [ + { + "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c601fad4-d0f2-4e8d-90cd-877a3e91d928", + "value": "331529" + }, + { + "description": "Fabricated Metal Product Manufacturing", + "related": [ + { + "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d302c854-4c56-4876-ac7a-e1b73ba7ac21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "341e6aff-8023-46fb-b67f-8f64a58396ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "29117540-f6d6-40a4-b44c-d0cc154aad07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "value": "332" + }, + { + "description": "Forging and Stamping", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b07659f6-860b-46fa-836a-22b41430ab7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e08189e5-5006-4bae-9544-4cdbac897878", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "81f6a757-49b8-4dc0-843d-93602facd2c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0d29db77-5ca4-427d-8296-04f40ddca646", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "28c3b684-7ea5-4ee9-8e48-0c1fc8567906", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5610657c-9451-4ca3-a778-c956287b9707", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "value": "3321" + }, + { + "description": "Forging and Stamping", + "related": [ + { + "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b07659f6-860b-46fa-836a-22b41430ab7b", + "value": "33211" + }, + { + "description": "Iron and Steel Forging ", + "related": [ + { + "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e08189e5-5006-4bae-9544-4cdbac897878", + "value": "332111" + }, + { + "description": "Nonferrous Forging ", + "related": [ + { + "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "81f6a757-49b8-4dc0-843d-93602facd2c6", + "value": "332112" + }, + { + "description": "Custom Roll Forming ", + "related": [ + { + "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0d29db77-5ca4-427d-8296-04f40ddca646", + "value": "332114" + }, + { + "description": "Powder Metallurgy Part Manufacturing ", + "related": [ + { + "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "28c3b684-7ea5-4ee9-8e48-0c1fc8567906", + "value": "332117" + }, + { + "description": "Metal Crown, Closure, and Other Metal Stamping (except Automotive) ", + "related": [ + { + "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5610657c-9451-4ca3-a778-c956287b9707", + "value": "332119" + }, + { + "description": "Cutlery and Handtool Manufacturing", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "26395423-3f15-4e5b-8a62-a87628e457c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "56ca337d-1cdf-4c02-bba9-ec657ff8ee5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "79ccf8f5-2174-4ac6-9838-2064b40c5fbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d302c854-4c56-4876-ac7a-e1b73ba7ac21", + "value": "3322" + }, + { + "description": "Cutlery and Handtool Manufacturing", + "related": [ + { + "dest-uuid": "d302c854-4c56-4876-ac7a-e1b73ba7ac21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "26395423-3f15-4e5b-8a62-a87628e457c2", + "value": "33221" + }, + { + "description": "Metal Kitchen Cookware, Utensil, Cutlery, and Flatware (except Precious) Manufacturing ", + "related": [ + { + "dest-uuid": "d302c854-4c56-4876-ac7a-e1b73ba7ac21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "56ca337d-1cdf-4c02-bba9-ec657ff8ee5e", + "value": "332215" + }, + { + "description": "Saw Blade and Handtool Manufacturing ", + "related": [ + { + "dest-uuid": "d302c854-4c56-4876-ac7a-e1b73ba7ac21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "79ccf8f5-2174-4ac6-9838-2064b40c5fbb", + "value": "332216" + }, + { + "description": "Architectural and Structural Metals Manufacturing", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "49655d60-9688-424f-9a12-c57303e31c30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dd64c5e1-33c8-41f8-b1a7-d96bea88e4c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a74debb3-9564-4684-81b2-0a2a3362974d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "52693522-82a1-43ec-99fb-aa61f23e9137", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cecc13de-2c9c-4c63-a787-79a978322371", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "28fd5110-2283-477b-a6c8-4340ccf857b8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c043fd2d-c0e4-4844-9c6a-11bc74e99747", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c45d0a1f-2366-4df1-bf9f-3b322b017ef8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "value": "3323" + }, + { + "description": "Plate Work and Fabricated Structural Product Manufacturing", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "49655d60-9688-424f-9a12-c57303e31c30", + "value": "33231" + }, + { + "description": "Prefabricated Metal Building and Component Manufacturing ", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dd64c5e1-33c8-41f8-b1a7-d96bea88e4c3", + "value": "332311" + }, + { + "description": "Fabricated Structural Metal Manufacturing ", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a74debb3-9564-4684-81b2-0a2a3362974d", + "value": "332312" + }, + { + "description": "Plate Work Manufacturing ", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "52693522-82a1-43ec-99fb-aa61f23e9137", + "value": "332313" + }, + { + "description": "Ornamental and Architectural Metal Products Manufacturing", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cecc13de-2c9c-4c63-a787-79a978322371", + "value": "33232" + }, + { + "description": "Metal Window and Door Manufacturing ", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "28fd5110-2283-477b-a6c8-4340ccf857b8", + "value": "332321" + }, + { + "description": "Sheet Metal Work Manufacturing ", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c043fd2d-c0e4-4844-9c6a-11bc74e99747", + "value": "332322" + }, + { + "description": "Ornamental and Architectural Metal Work Manufacturing ", + "related": [ + { + "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c45d0a1f-2366-4df1-bf9f-3b322b017ef8", + "value": "332323" + }, + { + "description": "Boiler, Tank, and Shipping Container Manufacturing", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "38109b0b-109f-474e-9428-332f75a2ba51", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d0559d75-1cfc-4207-bc4c-dc6a04a1b08e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8e21f4f0-8c33-4ff9-bbe6-8d7905bed392", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "20324245-87fc-47dd-b144-89162f9a6a9b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "55542b40-b3d1-4229-ad2b-28b19671741c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7dff2da0-6208-43e8-a2f7-9951ea2ea5c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "007c2991-51b9-48c4-a60d-839b3713d02d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "value": "3324" + }, + { + "description": "Power Boiler and Heat Exchanger Manufacturing", + "related": [ + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d0559d75-1cfc-4207-bc4c-dc6a04a1b08e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "38109b0b-109f-474e-9428-332f75a2ba51", + "value": "33241" + }, + { + "description": "Power Boiler and Heat Exchanger Manufacturing", + "related": [ + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "38109b0b-109f-474e-9428-332f75a2ba51", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d0559d75-1cfc-4207-bc4c-dc6a04a1b08e", + "value": "332410" + }, + { + "description": "Metal Tank (Heavy Gauge) Manufacturing", + "related": [ + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "20324245-87fc-47dd-b144-89162f9a6a9b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8e21f4f0-8c33-4ff9-bbe6-8d7905bed392", + "value": "33242" + }, + { + "description": "Metal Tank (Heavy Gauge) Manufacturing", + "related": [ + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8e21f4f0-8c33-4ff9-bbe6-8d7905bed392", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "20324245-87fc-47dd-b144-89162f9a6a9b", + "value": "332420" + }, + { + "description": "Metal Can, Box, and Other Metal Container (Light Gauge) Manufacturing", + "related": [ + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "55542b40-b3d1-4229-ad2b-28b19671741c", + "value": "33243" + }, + { + "description": "Metal Can Manufacturing ", + "related": [ + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7dff2da0-6208-43e8-a2f7-9951ea2ea5c5", + "value": "332431" + }, + { + "description": "Other Metal Container Manufacturing ", + "related": [ + { + "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "007c2991-51b9-48c4-a60d-839b3713d02d", + "value": "332439" + }, + { + "description": "Hardware Manufacturing", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8d6af1c2-9bd5-4e8b-a4fe-d411d7a41066", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "736803f5-52c9-4ebe-b11c-40c7a7731bd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "341e6aff-8023-46fb-b67f-8f64a58396ea", + "value": "3325" + }, + { + "description": "Hardware Manufacturing", + "related": [ + { + "dest-uuid": "341e6aff-8023-46fb-b67f-8f64a58396ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "736803f5-52c9-4ebe-b11c-40c7a7731bd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8d6af1c2-9bd5-4e8b-a4fe-d411d7a41066", + "value": "33251" + }, + { + "description": "Hardware Manufacturing", + "related": [ + { + "dest-uuid": "341e6aff-8023-46fb-b67f-8f64a58396ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8d6af1c2-9bd5-4e8b-a4fe-d411d7a41066", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "736803f5-52c9-4ebe-b11c-40c7a7731bd4", + "value": "332510" + }, + { + "description": "Spring and Wire Product Manufacturing", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "508b0cd1-ba98-4f51-8aab-c5ea41c524a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fc97af9c-2a38-46bf-9839-4899ee94b92a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1e7b4ebb-92d7-4535-8713-1e927b2d122d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "29117540-f6d6-40a4-b44c-d0cc154aad07", + "value": "3326" + }, + { + "description": "Spring and Wire Product Manufacturing", + "related": [ + { + "dest-uuid": "29117540-f6d6-40a4-b44c-d0cc154aad07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "508b0cd1-ba98-4f51-8aab-c5ea41c524a1", + "value": "33261" + }, + { + "description": "Spring Manufacturing ", + "related": [ + { + "dest-uuid": "29117540-f6d6-40a4-b44c-d0cc154aad07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fc97af9c-2a38-46bf-9839-4899ee94b92a", + "value": "332613" + }, + { + "description": "Other Fabricated Wire Product Manufacturing ", + "related": [ + { + "dest-uuid": "29117540-f6d6-40a4-b44c-d0cc154aad07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1e7b4ebb-92d7-4535-8713-1e927b2d122d", + "value": "332618" + }, + { + "description": "Machine Shops; Turned Product; and Screw, Nut, and Bolt Manufacturing", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "afd37323-1086-446f-a4ca-5114f2183617", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "30c8f7dd-a027-4fc1-b719-d7f46b644c58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "34f81cc4-f566-4799-b45b-515543606c1b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "113b1b10-1e0c-4bcb-b29c-5c8a55fc5063", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cfb71f2b-e250-433b-b55f-808b11a20848", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", + "value": "3327" + }, + { + "description": "Machine Shops", + "related": [ + { + "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "30c8f7dd-a027-4fc1-b719-d7f46b644c58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "afd37323-1086-446f-a4ca-5114f2183617", + "value": "33271" + }, + { + "description": "Machine Shops", + "related": [ + { + "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "afd37323-1086-446f-a4ca-5114f2183617", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "30c8f7dd-a027-4fc1-b719-d7f46b644c58", + "value": "332710" + }, + { + "description": "Turned Product and Screw, Nut, and Bolt Manufacturing", + "related": [ + { + "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "34f81cc4-f566-4799-b45b-515543606c1b", + "value": "33272" + }, + { + "description": "Precision Turned Product Manufacturing ", + "related": [ + { + "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "113b1b10-1e0c-4bcb-b29c-5c8a55fc5063", + "value": "332721" + }, + { + "description": "Bolt, Nut, Screw, Rivet, and Washer Manufacturing ", + "related": [ + { + "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cfb71f2b-e250-433b-b55f-808b11a20848", + "value": "332722" + }, + { + "description": "Coating, Engraving, Heat Treating, and Allied Activities", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1b872583-caf2-4089-85df-88cff139825c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d7fb83d7-b6f2-4e61-9d72-902c6949ac41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "88e1a0a1-2d48-4dd7-a608-c0c64acf034d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "884dba11-d0b9-436f-862f-7ea193192beb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", + "value": "3328" + }, + { + "description": "Coating, Engraving, Heat Treating, and Allied Activities", + "related": [ + { + "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1b872583-caf2-4089-85df-88cff139825c", + "value": "33281" + }, + { + "description": "Metal Heat Treating ", + "related": [ + { + "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d7fb83d7-b6f2-4e61-9d72-902c6949ac41", + "value": "332811" + }, + { + "description": "Metal Coating, Engraving (except Jewelry and Silverware), and Allied Services to Manufacturers ", + "related": [ + { + "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "88e1a0a1-2d48-4dd7-a608-c0c64acf034d", + "value": "332812" + }, + { + "description": "Electroplating, Plating, Polishing, Anodizing, and Coloring ", + "related": [ + { + "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "884dba11-d0b9-436f-862f-7ea193192beb", + "value": "332813" + }, + { + "description": "Other Fabricated Metal Product Manufacturing", + "related": [ + { + "dest-uuid": "7bf4d59a-dbd7-45aa-b0d6-822b17cc5194", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd605c99-a963-44ac-9a6c-efea51c1c860", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f379d517-8cfc-4209-a7d8-72b2c863689d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ea3e05f4-ba95-4321-82fb-e605f7cf2dae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bc0a9467-307b-49db-ab2b-5148123b6e1e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5234b5bd-c787-4047-b6b3-fa43ca057ad9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7bc475fc-9c6d-402b-8e79-5c3fe2962711", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9319501d-35c3-46d2-b719-18dede2d2a47", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bd5f2373-b0ab-45f3-ac2d-ec492c8e9446", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1a90e7da-7323-470a-9170-99004408a6a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ecac7de7-79ee-48c7-9d5a-68b1d45befb7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "56cb45e7-fb1d-4329-a4be-251677eabf84", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9313ceae-d85d-4619-8a9d-332022e66f1e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "value": "3329" + }, + { + "description": "Metal Valve Manufacturing", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fd605c99-a963-44ac-9a6c-efea51c1c860", + "value": "33291" + }, + { + "description": "Industrial Valve Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f379d517-8cfc-4209-a7d8-72b2c863689d", + "value": "332911" + }, + { + "description": "Fluid Power Valve and Hose Fitting Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ea3e05f4-ba95-4321-82fb-e605f7cf2dae", + "value": "332912" + }, + { + "description": "Plumbing Fixture Fitting and Trim Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bc0a9467-307b-49db-ab2b-5148123b6e1e", + "value": "332913" + }, + { + "description": "Other Metal Valve and Pipe Fitting Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5234b5bd-c787-4047-b6b3-fa43ca057ad9", + "value": "332919" + }, + { + "description": "All Other Fabricated Metal Product Manufacturing", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7bc475fc-9c6d-402b-8e79-5c3fe2962711", + "value": "33299" + }, + { + "description": "Ball and Roller Bearing Manufacturing", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9319501d-35c3-46d2-b719-18dede2d2a47", + "value": "332991" + }, + { + "description": "Small Arms Ammunition Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bd5f2373-b0ab-45f3-ac2d-ec492c8e9446", + "value": "332992" + }, + { + "description": "Ammunition (except Small Arms) Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1a90e7da-7323-470a-9170-99004408a6a1", + "value": "332993" + }, + { + "description": "Small Arms, Ordnance, and Ordnance Accessories Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ecac7de7-79ee-48c7-9d5a-68b1d45befb7", + "value": "332994" + }, + { + "description": "Fabricated Pipe and Pipe Fitting Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "56cb45e7-fb1d-4329-a4be-251677eabf84", + "value": "332996" + }, + { + "description": "All Other Miscellaneous Fabricated Metal Product Manufacturing ", + "related": [ + { + "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9313ceae-d85d-4619-8a9d-332022e66f1e", + "value": "332999" + }, + { + "description": "Machinery Manufacturing", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cc8fb95f-3953-4fba-90ca-30da5d0a1f78", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "value": "333" + }, + { + "description": "Agriculture, Construction, and Mining Machinery Manufacturing", + "related": [ + { + "dest-uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fa332ca3-2fee-41db-817b-233df6d5787e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b8f931da-2deb-4442-b7bd-62cf9283e7ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "25f0dc27-359f-4c4e-8c33-40c811895929", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a9538535-82d8-4c3e-82e3-c4eb28a087da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cc671b68-ca59-4a3f-9140-9e84d238f9b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "59c98b32-452c-47ff-9830-7711352bb190", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "80326a76-5308-480a-9ab2-5ff14a407d24", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f54e8aa4-b414-4d81-bdb8-2d9444335b02", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "value": "3331" + }, + { + "description": "Agricultural Implement Manufacturing", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fa332ca3-2fee-41db-817b-233df6d5787e", + "value": "33311" + }, + { + "description": "Farm Machinery and Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b8f931da-2deb-4442-b7bd-62cf9283e7ca", + "value": "333111" + }, + { + "description": "Lawn and Garden Tractor and Home Lawn and Garden Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "25f0dc27-359f-4c4e-8c33-40c811895929", + "value": "333112" + }, + { + "description": "Construction Machinery Manufacturing", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cc671b68-ca59-4a3f-9140-9e84d238f9b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a9538535-82d8-4c3e-82e3-c4eb28a087da", + "value": "33312" + }, + { + "description": "Construction Machinery Manufacturing", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a9538535-82d8-4c3e-82e3-c4eb28a087da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cc671b68-ca59-4a3f-9140-9e84d238f9b7", + "value": "333120" + }, + { + "description": "Mining and Oil and Gas Field Machinery Manufacturing", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "59c98b32-452c-47ff-9830-7711352bb190", + "value": "33313" + }, + { + "description": "Mining Machinery and Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "80326a76-5308-480a-9ab2-5ff14a407d24", + "value": "333131" + }, + { + "description": "Oil and Gas Field Machinery and Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f54e8aa4-b414-4d81-bdb8-2d9444335b02", + "value": "333132" + }, + { + "description": "Industrial Machinery Manufacturing", + "related": [ + { + "dest-uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5164267e-4aa9-4827-999e-47ad5d6f38e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b2f0f23f-8d66-4d26-9ead-4106ce683a10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cd64d2cb-0ba9-45ff-b3a9-095f7228e296", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "34fc2a57-43a6-4aa7-84e4-bfba2611f6c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "01adb08a-799e-4248-b23a-ccb5fcf3a809", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", + "value": "3332" + }, + { + "description": "Industrial Machinery Manufacturing", + "related": [ + { + "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5164267e-4aa9-4827-999e-47ad5d6f38e7", + "value": "33324" + }, + { + "description": "Food Product Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b2f0f23f-8d66-4d26-9ead-4106ce683a10", + "value": "333241" + }, + { + "description": "Semiconductor Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cd64d2cb-0ba9-45ff-b3a9-095f7228e296", + "value": "333242" + }, + { + "description": "Sawmill, Woodworking, and Paper Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "34fc2a57-43a6-4aa7-84e4-bfba2611f6c2", + "value": "333243" + }, + { + "description": "All Other Industrial Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "01adb08a-799e-4248-b23a-ccb5fcf3a809", + "value": "333248" + }, + { + "description": "Commercial and Service Industry Machinery Manufacturing", + "related": [ + { + "dest-uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "412d85eb-bfa7-411d-8331-98635057f09c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "863f9357-d085-4a6e-8a52-3c4d4dcb8339", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cc8fb95f-3953-4fba-90ca-30da5d0a1f78", + "value": "3333" + }, + { + "description": "Commercial and Service Industry Machinery Manufacturing", + "related": [ + { + "dest-uuid": "cc8fb95f-3953-4fba-90ca-30da5d0a1f78", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "863f9357-d085-4a6e-8a52-3c4d4dcb8339", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "412d85eb-bfa7-411d-8331-98635057f09c", + "value": "33331" + }, + { + "description": "Commercial and Service Industry Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "cc8fb95f-3953-4fba-90ca-30da5d0a1f78", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "412d85eb-bfa7-411d-8331-98635057f09c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "863f9357-d085-4a6e-8a52-3c4d4dcb8339", + "value": "333310" + }, + { + "description": "Ventilation, Heating, Air-Conditioning, and Commercial Refrigeration Equipment Manufacturing", + "related": [ + { + "dest-uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "99071f82-651d-4b0d-b55e-b2bfc7d7f51e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e917f0a2-d699-43dc-a247-c67317b92fd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dad1e0ad-01d6-4c8c-8533-428ffaff1c75", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "38bad5dc-c4e4-4b03-97d8-a5c9a2289b08", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d8232281-6076-4b2f-83df-bebffbd31695", + "value": "3334" + }, + { + "description": "Ventilation, Heating, Air-Conditioning, and Commercial Refrigeration Equipment Manufacturing", + "related": [ + { + "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "99071f82-651d-4b0d-b55e-b2bfc7d7f51e", + "value": "33341" + }, + { + "description": "Industrial and Commercial Fan and Blower and Air Purification Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e917f0a2-d699-43dc-a247-c67317b92fd4", + "value": "333413" + }, + { + "description": "Heating Equipment (except Warm Air Furnaces) Manufacturing ", + "related": [ + { + "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dad1e0ad-01d6-4c8c-8533-428ffaff1c75", + "value": "333414" + }, + { + "description": "Air-Conditioning and Warm Air Heating Equipment and Commercial and Industrial Refrigeration Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "38bad5dc-c4e4-4b03-97d8-a5c9a2289b08", + "value": "333415" + }, + { + "description": "Metalworking Machinery Manufacturing", + "related": [ + { + "dest-uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a686781-2c21-4531-b8c2-8a4c699991ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ec38732c-ebea-4059-bb1d-8b123daead01", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "093e4e16-7def-48bb-b81f-eb42ee4bb402", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c817cc1c-ab78-4208-a05a-f42af0896925", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "af301342-c007-48f4-a2e1-5c573948ff8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2f305b97-97e2-4a6d-90b0-d15e49029e8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "value": "3335" + }, + { + "description": "Metalworking Machinery Manufacturing", + "related": [ + { + "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3a686781-2c21-4531-b8c2-8a4c699991ab", + "value": "33351" + }, + { + "description": "Industrial Mold Manufacturing ", + "related": [ + { + "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ec38732c-ebea-4059-bb1d-8b123daead01", + "value": "333511" + }, + { + "description": "Special Die and Tool, Die Set, Jig, and Fixture Manufacturing ", + "related": [ + { + "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "093e4e16-7def-48bb-b81f-eb42ee4bb402", + "value": "333514" + }, + { + "description": "Cutting Tool and Machine Tool Accessory Manufacturing ", + "related": [ + { + "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c817cc1c-ab78-4208-a05a-f42af0896925", + "value": "333515" + }, + { + "description": "Machine Tool Manufacturing ", + "related": [ + { + "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "af301342-c007-48f4-a2e1-5c573948ff8e", + "value": "333517" + }, + { + "description": "Rolling Mill and Other Metalworking Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2f305b97-97e2-4a6d-90b0-d15e49029e8e", + "value": "333519" + }, + { + "description": "Engine, Turbine, and Power Transmission Equipment Manufacturing", + "related": [ + { + "dest-uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "806e1898-9a43-4ca6-ad67-a0c49a339bc3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "800dccd2-dff4-482b-9d19-ce63adbda280", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d0c4968-3a64-48cc-935c-89e2726242ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e04d9d6b-e691-4874-98f1-0b385eb90e58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c258c8d7-fe65-4e67-99d4-647663920164", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", + "value": "3336" + }, + { + "description": "Engine, Turbine, and Power Transmission Equipment Manufacturing", + "related": [ + { + "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "806e1898-9a43-4ca6-ad67-a0c49a339bc3", + "value": "33361" + }, + { + "description": "Turbine and Turbine Generator Set Units Manufacturing ", + "related": [ + { + "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "800dccd2-dff4-482b-9d19-ce63adbda280", + "value": "333611" + }, + { + "description": "Speed Changer, Industrial High-Speed Drive, and Gear Manufacturing ", + "related": [ + { + "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7d0c4968-3a64-48cc-935c-89e2726242ed", + "value": "333612" + }, + { + "description": "Mechanical Power Transmission Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e04d9d6b-e691-4874-98f1-0b385eb90e58", + "value": "333613" + }, + { + "description": "Other Engine Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c258c8d7-fe65-4e67-99d4-647663920164", + "value": "333618" + }, + { + "description": "Other General Purpose Machinery Manufacturing", + "related": [ + { + "dest-uuid": "8d06db47-2842-4f2a-9f01-9930e7b03c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f9881a1b-2be9-4cbf-aaab-fb0b242d459c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d690b650-5907-4edd-abc8-9177d86088e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9126e39a-bd99-422e-8352-f2ca368a5316", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5f6494f8-03e7-4178-a496-cbdb019da5d2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9b7d12ac-f8ed-426a-a7af-bddafd20fee9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e9d847a4-0a83-4398-825a-ecf5f3e9b221", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "430bde6a-0335-4480-9b74-54383f03e68a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e7d5243e-90a8-4381-a04c-66aaab1688fd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ba9c6a17-ac40-4532-91e2-1df70e75d91d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d0ef5e28-14ed-45d1-83ba-4f1371fb313a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "da63b123-8257-4bb5-af95-2a248e36e9b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "403ae2cc-09ae-4716-8b37-10eef9d2564f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f6aba723-e41d-4ea0-8678-fc24f2b1ca10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "00fdbae9-fb9b-473a-a7e5-153d10ab1564", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a5050f3c-f3e6-42e2-ad69-970377942714", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0505abc1-deca-4da2-9382-29a7a6d88de0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "value": "3339" + }, + { + "description": "Pump and Compressor Manufacturing", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f9881a1b-2be9-4cbf-aaab-fb0b242d459c", + "value": "33391" + }, + { + "description": "Air and Gas Compressor Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d690b650-5907-4edd-abc8-9177d86088e7", + "value": "333912" + }, + { + "description": "Measuring, Dispensing, and Other Pumping Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9126e39a-bd99-422e-8352-f2ca368a5316", + "value": "333914" + }, + { + "description": "Material Handling Equipment Manufacturing", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5f6494f8-03e7-4178-a496-cbdb019da5d2", + "value": "33392" + }, + { + "description": "Elevator and Moving Stairway Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9b7d12ac-f8ed-426a-a7af-bddafd20fee9", + "value": "333921" + }, + { + "description": "Conveyor and Conveying Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e9d847a4-0a83-4398-825a-ecf5f3e9b221", + "value": "333922" + }, + { + "description": "Overhead Traveling Crane, Hoist, and Monorail System Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "430bde6a-0335-4480-9b74-54383f03e68a", + "value": "333923" + }, + { + "description": "Industrial Truck, Tractor, Trailer, and Stacker Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e7d5243e-90a8-4381-a04c-66aaab1688fd", + "value": "333924" + }, + { + "description": "All Other General Purpose Machinery Manufacturing", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ba9c6a17-ac40-4532-91e2-1df70e75d91d", + "value": "33399" + }, + { + "description": "Power-Driven Handtool Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d0ef5e28-14ed-45d1-83ba-4f1371fb313a", + "value": "333991" + }, + { + "description": "Welding and Soldering Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "da63b123-8257-4bb5-af95-2a248e36e9b1", + "value": "333992" + }, + { + "description": "Packaging Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "403ae2cc-09ae-4716-8b37-10eef9d2564f", + "value": "333993" + }, + { + "description": "Industrial Process Furnace and Oven Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f6aba723-e41d-4ea0-8678-fc24f2b1ca10", + "value": "333994" + }, + { + "description": "Fluid Power Cylinder and Actuator Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "00fdbae9-fb9b-473a-a7e5-153d10ab1564", + "value": "333995" + }, + { + "description": "Fluid Power Pump and Motor Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a5050f3c-f3e6-42e2-ad69-970377942714", + "value": "333996" + }, + { + "description": "All Other Miscellaneous General Purpose Machinery Manufacturing ", + "related": [ + { + "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0505abc1-deca-4da2-9382-29a7a6d88de0", + "value": "333998" + }, + { + "description": "Computer and Electronic Product Manufacturing", + "related": [ + { + "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fcd95ee5-99ab-4dd2-ba80-abc13e63808f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bf9483a5-95dc-409a-bdb7-fd19148259f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "23d82179-b45c-440b-8904-b33bbd251484", + "value": "334" + }, + { + "description": "Computer and Peripheral Equipment Manufacturing", + "related": [ + { + "dest-uuid": "23d82179-b45c-440b-8904-b33bbd251484", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "69d38dcc-f53f-4fd5-a764-ccb12cca995c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dcc4bc5c-a43b-498e-b706-45acded4753f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1b17eb1d-06cf-4f12-bd6e-c321e784367b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9f306272-1781-4c3f-93d3-231797e44a7e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", + "value": "3341" + }, + { + "description": "Computer and Peripheral Equipment Manufacturing", + "related": [ + { + "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "69d38dcc-f53f-4fd5-a764-ccb12cca995c", + "value": "33411" + }, + { + "description": "Electronic Computer Manufacturing ", + "related": [ + { + "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dcc4bc5c-a43b-498e-b706-45acded4753f", + "value": "334111" + }, + { + "description": "Computer Storage Device Manufacturing ", + "related": [ + { + "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1b17eb1d-06cf-4f12-bd6e-c321e784367b", + "value": "334112" + }, + { + "description": "Computer Terminal and Other Computer Peripheral Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9f306272-1781-4c3f-93d3-231797e44a7e", + "value": "334118" + }, + { + "description": "Communications Equipment Manufacturing", + "related": [ + { + "dest-uuid": "23d82179-b45c-440b-8904-b33bbd251484", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c506a635-ead6-41fa-9bc2-2ffedb0aec5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0745e46f-b0bd-4c30-9ada-7582c5f63d3f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e830e8c8-7bfb-42c7-9674-adfc09602148", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "680f9c62-c647-450d-8647-056845db48b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "81a5a35d-89fe-47a9-8b03-d0481c509c73", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a7675bc8-d638-4dbc-b064-0b3ce1fb2d51", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "value": "3342" + }, + { + "description": "Telephone Apparatus Manufacturing", + "related": [ + { + "dest-uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0745e46f-b0bd-4c30-9ada-7582c5f63d3f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c506a635-ead6-41fa-9bc2-2ffedb0aec5d", + "value": "33421" + }, + { + "description": "Telephone Apparatus Manufacturing", + "related": [ + { + "dest-uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c506a635-ead6-41fa-9bc2-2ffedb0aec5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0745e46f-b0bd-4c30-9ada-7582c5f63d3f", + "value": "334210" + }, + { + "description": "Radio and Television Broadcasting and Wireless Communications Equipment Manufacturing", + "related": [ + { + "dest-uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "680f9c62-c647-450d-8647-056845db48b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e830e8c8-7bfb-42c7-9674-adfc09602148", + "value": "33422" + }, + { + "description": "Radio and Television Broadcasting and Wireless Communications Equipment Manufacturing", + "related": [ + { + "dest-uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e830e8c8-7bfb-42c7-9674-adfc09602148", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "680f9c62-c647-450d-8647-056845db48b7", + "value": "334220" + }, + { + "description": "Other Communications Equipment Manufacturing", + "related": [ + { + "dest-uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a7675bc8-d638-4dbc-b064-0b3ce1fb2d51", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "81a5a35d-89fe-47a9-8b03-d0481c509c73", + "value": "33429" + }, + { + "description": "Other Communications Equipment Manufacturing", + "related": [ + { + "dest-uuid": "5303d375-6f09-4053-8064-e6aa5ee40d38", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "81a5a35d-89fe-47a9-8b03-d0481c509c73", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a7675bc8-d638-4dbc-b064-0b3ce1fb2d51", + "value": "334290" + }, + { + "description": "Audio and Video Equipment Manufacturing", + "related": [ + { + "dest-uuid": "23d82179-b45c-440b-8904-b33bbd251484", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b9cb00dd-e0cd-4ce9-a8fc-2509b84e74a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ed0d02fb-9be9-47e7-9e61-c143138d410b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "fcd95ee5-99ab-4dd2-ba80-abc13e63808f", + "value": "3343" + }, + { + "description": "Audio and Video Equipment Manufacturing", + "related": [ + { + "dest-uuid": "fcd95ee5-99ab-4dd2-ba80-abc13e63808f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ed0d02fb-9be9-47e7-9e61-c143138d410b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b9cb00dd-e0cd-4ce9-a8fc-2509b84e74a7", + "value": "33431" + }, + { + "description": "Audio and Video Equipment Manufacturing", + "related": [ + { + "dest-uuid": "fcd95ee5-99ab-4dd2-ba80-abc13e63808f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b9cb00dd-e0cd-4ce9-a8fc-2509b84e74a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ed0d02fb-9be9-47e7-9e61-c143138d410b", + "value": "334310" + }, + { + "description": "Semiconductor and Other Electronic Component Manufacturing", + "related": [ + { + "dest-uuid": "23d82179-b45c-440b-8904-b33bbd251484", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8677acbf-60e6-4681-aaa2-a3010632f7a4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d48edd8-965d-43d6-9923-14c9f04f654a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "73a04240-3d00-4f87-a2ba-26a2320c4922", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "34aaeb44-94b5-4749-bed8-2c2fc4342bf7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f1d1c752-25b8-4993-833c-59c16e0ba9c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bfacd1a1-8434-4293-9959-43d00d2fa24c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a6a425cf-9440-45c4-8e98-ad92786fcd64", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "value": "3344" + }, + { + "description": "Semiconductor and Other Electronic Component Manufacturing", + "related": [ + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8677acbf-60e6-4681-aaa2-a3010632f7a4", + "value": "33441" + }, + { + "description": "Bare Printed Circuit Board Manufacturing ", + "related": [ + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7d48edd8-965d-43d6-9923-14c9f04f654a", + "value": "334412" + }, + { + "description": "Semiconductor and Related Device Manufacturing ", + "related": [ + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "73a04240-3d00-4f87-a2ba-26a2320c4922", + "value": "334413" + }, + { + "description": "Capacitor, Resistor, Coil, Transformer, and Other Inductor Manufacturing ", + "related": [ + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "34aaeb44-94b5-4749-bed8-2c2fc4342bf7", + "value": "334416" + }, + { + "description": "Electronic Connector Manufacturing ", + "related": [ + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f1d1c752-25b8-4993-833c-59c16e0ba9c5", + "value": "334417" + }, + { + "description": "Printed Circuit Assembly (Electronic Assembly) Manufacturing ", + "related": [ + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bfacd1a1-8434-4293-9959-43d00d2fa24c", + "value": "334418" + }, + { + "description": "Other Electronic Component Manufacturing ", + "related": [ + { + "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a6a425cf-9440-45c4-8e98-ad92786fcd64", + "value": "334419" + }, + { + "description": "Navigational, Measuring, Electromedical, and Control Instruments Manufacturing", + "related": [ + { + "dest-uuid": "23d82179-b45c-440b-8904-b33bbd251484", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8995462-836f-47ea-b062-cff04db59c35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2b5168d2-6c3d-4ec2-a8dd-f966864d567f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "acacabce-ccb7-42ad-92c9-6f2e551700d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c3007621-8376-4513-92db-2cf9a1f50e71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "02567624-3b36-436c-bcb3-f05a0cf5431e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "56811113-b145-4ed6-a232-24e7f4ff55c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f8ed77cd-7351-4eb6-9e57-2f4c835cd89e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f806371d-d717-4bf4-bbb9-232c8773925d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1461bdba-b655-408a-8159-0b289246c8a4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bdc3b58d-d469-481f-8f8a-c7aabddaaf55", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "value": "3345" + }, + { + "description": "Navigational, Measuring, Electromedical, and Control Instruments Manufacturing", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b5168d2-6c3d-4ec2-a8dd-f966864d567f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c8995462-836f-47ea-b062-cff04db59c35", + "value": "33451" + }, + { + "description": "Electromedical and Electrotherapeutic Apparatus Manufacturing ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8995462-836f-47ea-b062-cff04db59c35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2b5168d2-6c3d-4ec2-a8dd-f966864d567f", + "value": "334510" + }, + { + "description": "Search, Detection, Navigation, Guidance, Aeronautical, and Nautical System and Instrument Manufacturing ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "acacabce-ccb7-42ad-92c9-6f2e551700d1", + "value": "334511" + }, + { + "description": "Automatic Environmental Control Manufacturing for Residential, Commercial, and Appliance Use ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c3007621-8376-4513-92db-2cf9a1f50e71", + "value": "334512" + }, + { + "description": "Instruments and Related Products Manufacturing for Measuring, Displaying, and Controlling Industrial Process Variables ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "02567624-3b36-436c-bcb3-f05a0cf5431e", + "value": "334513" + }, + { + "description": "Totalizing Fluid Meter and Counting Device Manufacturing ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "56811113-b145-4ed6-a232-24e7f4ff55c6", + "value": "334514" + }, + { + "description": "Instrument Manufacturing for Measuring and Testing Electricity and Electrical Signals ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f8ed77cd-7351-4eb6-9e57-2f4c835cd89e", + "value": "334515" + }, + { + "description": "Analytical Laboratory Instrument Manufacturing ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f806371d-d717-4bf4-bbb9-232c8773925d", + "value": "334516" + }, + { + "description": "Irradiation Apparatus Manufacturing ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1461bdba-b655-408a-8159-0b289246c8a4", + "value": "334517" + }, + { + "description": "Other Measuring and Controlling Device Manufacturing ", + "related": [ + { + "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bdc3b58d-d469-481f-8f8a-c7aabddaaf55", + "value": "334519" + }, + { + "description": "Manufacturing and Reproducing Magnetic and Optical Media", + "related": [ + { + "dest-uuid": "23d82179-b45c-440b-8904-b33bbd251484", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8564de50-2271-41e3-8ccf-7fc5fd770def", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "73defa63-a73e-4d2a-87d0-80465857bfc9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bf9483a5-95dc-409a-bdb7-fd19148259f9", + "value": "3346" + }, + { + "description": "Manufacturing and Reproducing Magnetic and Optical Media", + "related": [ + { + "dest-uuid": "bf9483a5-95dc-409a-bdb7-fd19148259f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "73defa63-a73e-4d2a-87d0-80465857bfc9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8564de50-2271-41e3-8ccf-7fc5fd770def", + "value": "33461" + }, + { + "description": "Manufacturing and Reproducing Magnetic and Optical Media ", + "related": [ + { + "dest-uuid": "bf9483a5-95dc-409a-bdb7-fd19148259f9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8564de50-2271-41e3-8ccf-7fc5fd770def", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "73defa63-a73e-4d2a-87d0-80465857bfc9", + "value": "334610" + }, + { + "description": "Electrical Equipment, Appliance, and Component Manufacturing", + "related": [ + { + "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "475d454c-8cab-4bac-977e-0465be40abb1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1aa15133-7867-4803-b4d3-b2442ea66b58", + "value": "335" + }, + { + "description": "Electric Lighting Equipment Manufacturing", + "related": [ + { + "dest-uuid": "1aa15133-7867-4803-b4d3-b2442ea66b58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f31e3332-c905-4af0-b1f3-fdcd17eb83b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e287f5f4-b1df-4edc-8aac-04ffc3bc53ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2e70cf28-51a4-47ce-8420-64d4c3fd49ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a4fac569-a455-4bec-9511-4915cc20da71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", + "value": "3351" + }, + { + "description": "Electric Lighting Equipment Manufacturing", + "related": [ + { + "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f31e3332-c905-4af0-b1f3-fdcd17eb83b0", + "value": "33513" + }, + { + "description": "Residential Electric Lighting Fixture Manufacturing ", + "related": [ + { + "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e287f5f4-b1df-4edc-8aac-04ffc3bc53ac", + "value": "335131" + }, + { + "description": "Commercial, Industrial, and Institutional Electric Lighting Fixture Manufacturing ", + "related": [ + { + "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2e70cf28-51a4-47ce-8420-64d4c3fd49ec", + "value": "335132" + }, + { + "description": "Electric Lamp Bulb and Other Lighting Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a4fac569-a455-4bec-9511-4915cc20da71", + "value": "335139" + }, + { + "description": "Household Appliance Manufacturing", + "related": [ + { + "dest-uuid": "1aa15133-7867-4803-b4d3-b2442ea66b58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "44e8bcdc-42e2-4f98-ada1-b2381cfaafb2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "570bd837-ea59-4bcb-944b-70e073db304c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bacc78c5-86d7-4f70-9ab9-4f818699bc09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c96a4197-2bb5-48c0-b259-a0f75924ca98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "475d454c-8cab-4bac-977e-0465be40abb1", + "value": "3352" + }, + { + "description": "Small Electrical Appliance Manufacturing", + "related": [ + { + "dest-uuid": "475d454c-8cab-4bac-977e-0465be40abb1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "570bd837-ea59-4bcb-944b-70e073db304c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "44e8bcdc-42e2-4f98-ada1-b2381cfaafb2", + "value": "33521" + }, + { + "description": "Small Electrical Appliance Manufacturing", + "related": [ + { + "dest-uuid": "475d454c-8cab-4bac-977e-0465be40abb1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "44e8bcdc-42e2-4f98-ada1-b2381cfaafb2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "570bd837-ea59-4bcb-944b-70e073db304c", + "value": "335210" + }, + { + "description": "Major Household Appliance Manufacturing ", + "related": [ + { + "dest-uuid": "475d454c-8cab-4bac-977e-0465be40abb1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c96a4197-2bb5-48c0-b259-a0f75924ca98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bacc78c5-86d7-4f70-9ab9-4f818699bc09", + "value": "33522" + }, + { + "description": "Major Household Appliance Manufacturing ", + "related": [ + { + "dest-uuid": "475d454c-8cab-4bac-977e-0465be40abb1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bacc78c5-86d7-4f70-9ab9-4f818699bc09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c96a4197-2bb5-48c0-b259-a0f75924ca98", + "value": "335220" + }, + { + "description": "Electrical Equipment Manufacturing", + "related": [ + { + "dest-uuid": "1aa15133-7867-4803-b4d3-b2442ea66b58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "72f28567-c11e-4e8c-bc7c-c22683c43068", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1fc9aa35-9566-4b82-aa9d-390269778fe6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d1cf272-0c20-4354-af25-1d85af300ad0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "47e19a79-bed7-41c8-9fc6-a48f3ccfacc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "67588d9c-371e-42a2-a400-9e12f2bb15c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", + "value": "3353" + }, + { + "description": "Electrical Equipment Manufacturing", + "related": [ + { + "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "72f28567-c11e-4e8c-bc7c-c22683c43068", + "value": "33531" + }, + { + "description": "Power, Distribution, and Specialty Transformer Manufacturing ", + "related": [ + { + "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1fc9aa35-9566-4b82-aa9d-390269778fe6", + "value": "335311" + }, + { + "description": "Motor and Generator Manufacturing ", + "related": [ + { + "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3d1cf272-0c20-4354-af25-1d85af300ad0", + "value": "335312" + }, + { + "description": "Switchgear and Switchboard Apparatus Manufacturing ", + "related": [ + { + "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "47e19a79-bed7-41c8-9fc6-a48f3ccfacc8", + "value": "335313" + }, + { + "description": "Relay and Industrial Control Manufacturing ", + "related": [ + { + "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "67588d9c-371e-42a2-a400-9e12f2bb15c6", + "value": "335314" + }, + { + "description": "Other Electrical Equipment and Component Manufacturing", + "related": [ + { + "dest-uuid": "1aa15133-7867-4803-b4d3-b2442ea66b58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fbc4ef15-b15a-4b23-8e60-1ee8f5eed729", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0f9e8e9c-c0b9-4f4c-be2d-04d597f66307", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aafe929e-608f-421d-94c6-fa7fa4c05734", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a54c6512-54aa-405a-bdea-c795aa20e770", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "872de867-0bef-49b3-b617-1e97edb64a6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2965c3a4-1670-458a-9a9d-b3a41ec95d15", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2e42cc9c-e605-43b3-b0e7-5fb61d45a831", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce6ddb82-e2f8-4add-a2b7-f05d8c6bf7c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cb10c065-9dfa-43af-872d-fdc6116f896a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b3c71b9b-4c08-4cae-acc6-5a1f6e41ba4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d6e00b5f-8aa3-4880-9213-ad14066985dd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "value": "3359" + }, + { + "description": "Battery Manufacturing", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0f9e8e9c-c0b9-4f4c-be2d-04d597f66307", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fbc4ef15-b15a-4b23-8e60-1ee8f5eed729", + "value": "33591" + }, + { + "description": "Battery Manufacturing ", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fbc4ef15-b15a-4b23-8e60-1ee8f5eed729", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0f9e8e9c-c0b9-4f4c-be2d-04d597f66307", + "value": "335910" + }, + { + "description": "Communication and Energy Wire and Cable Manufacturing", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "aafe929e-608f-421d-94c6-fa7fa4c05734", + "value": "33592" + }, + { + "description": "Fiber Optic Cable Manufacturing ", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a54c6512-54aa-405a-bdea-c795aa20e770", + "value": "335921" + }, + { + "description": "Other Communication and Energy Wire Manufacturing ", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "872de867-0bef-49b3-b617-1e97edb64a6f", + "value": "335929" + }, + { + "description": "Wiring Device Manufacturing", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2965c3a4-1670-458a-9a9d-b3a41ec95d15", + "value": "33593" + }, + { + "description": "Current-Carrying Wiring Device Manufacturing ", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2e42cc9c-e605-43b3-b0e7-5fb61d45a831", + "value": "335931" + }, + { + "description": "Noncurrent-Carrying Wiring Device Manufacturing ", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ce6ddb82-e2f8-4add-a2b7-f05d8c6bf7c5", + "value": "335932" + }, + { + "description": "All Other Electrical Equipment and Component Manufacturing", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cb10c065-9dfa-43af-872d-fdc6116f896a", + "value": "33599" + }, + { + "description": "Carbon and Graphite Product Manufacturing ", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b3c71b9b-4c08-4cae-acc6-5a1f6e41ba4a", + "value": "335991" + }, + { + "description": "All Other Miscellaneous Electrical Equipment and Component Manufacturing ", + "related": [ + { + "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d6e00b5f-8aa3-4880-9213-ad14066985dd", + "value": "335999" + }, + { + "description": "Transportation Equipment Manufacturing", + "related": [ + { + "dest-uuid": "ffed911c-ee44-49fa-9475-5f41c74013f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e944bc11-1db9-4953-baec-7f9f2955f337", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b72788bd-024e-4ee3-9ca0-4b7b48960d21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "value": "336" + }, + { + "description": "Motor Vehicle Manufacturing", + "related": [ + { + "dest-uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f3f40800-84a5-47c4-a986-a3b4d13bd004", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1d83a55b-ed7e-4416-bedb-227218f62b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c12034b8-7b17-4e9b-8ee8-4c53c7e9260d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "91d163d5-dc89-44c2-915d-c3daef40e185", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ffed911c-ee44-49fa-9475-5f41c74013f2", + "value": "3361" + }, + { + "description": "Automobile and Light Duty Motor Vehicle Manufacturing", + "related": [ + { + "dest-uuid": "ffed911c-ee44-49fa-9475-5f41c74013f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1d83a55b-ed7e-4416-bedb-227218f62b16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f3f40800-84a5-47c4-a986-a3b4d13bd004", + "value": "33611" + }, + { + "description": "Automobile and Light Duty Motor Vehicle Manufacturing ", + "related": [ + { + "dest-uuid": "ffed911c-ee44-49fa-9475-5f41c74013f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f3f40800-84a5-47c4-a986-a3b4d13bd004", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1d83a55b-ed7e-4416-bedb-227218f62b16", + "value": "336110" + }, + { + "description": "Heavy Duty Truck Manufacturing", + "related": [ + { + "dest-uuid": "ffed911c-ee44-49fa-9475-5f41c74013f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "91d163d5-dc89-44c2-915d-c3daef40e185", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c12034b8-7b17-4e9b-8ee8-4c53c7e9260d", + "value": "33612" + }, + { + "description": "Heavy Duty Truck Manufacturing", + "related": [ + { + "dest-uuid": "ffed911c-ee44-49fa-9475-5f41c74013f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c12034b8-7b17-4e9b-8ee8-4c53c7e9260d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "91d163d5-dc89-44c2-915d-c3daef40e185", + "value": "336120" + }, + { + "description": "Motor Vehicle Body and Trailer Manufacturing", + "related": [ + { + "dest-uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8ed59a86-d517-4192-94a5-5babf46d3040", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "15cc315b-a1f2-4f88-9c1d-fbbab2f956ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d68a39d-d384-4a63-adea-7c7ad7760fce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "38e77742-788d-4005-b6f3-00490bdc5093", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f0c22782-6b73-4301-ab87-1ad9e5d8fe85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "74f53c69-62b2-4a99-96b2-a474de576021", + "value": "3362" + }, + { + "description": "Motor Vehicle Body and Trailer Manufacturing", + "related": [ + { + "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8ed59a86-d517-4192-94a5-5babf46d3040", + "value": "33621" + }, + { + "description": "Motor Vehicle Body Manufacturing ", + "related": [ + { + "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "15cc315b-a1f2-4f88-9c1d-fbbab2f956ac", + "value": "336211" + }, + { + "description": "Truck Trailer Manufacturing ", + "related": [ + { + "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3d68a39d-d384-4a63-adea-7c7ad7760fce", + "value": "336212" + }, + { + "description": "Motor Home Manufacturing ", + "related": [ + { + "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "38e77742-788d-4005-b6f3-00490bdc5093", + "value": "336213" + }, + { + "description": "Travel Trailer and Camper Manufacturing ", + "related": [ + { + "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f0c22782-6b73-4301-ab87-1ad9e5d8fe85", + "value": "336214" + }, + { + "description": "Motor Vehicle Parts Manufacturing", + "related": [ + { + "dest-uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "88eb9aaa-8e3b-4cb8-b150-16bb8ac58c45", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5ef5cbc8-1134-4b45-bfde-c01a6f0f8896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bfbffc53-8828-4ec2-aded-653ceac8ea52", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1ca18cf3-47c1-4376-804e-1a70a29e43d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "39d8ad0c-edbe-4584-9400-565b403485b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fa6af269-a3fd-4a16-b5bd-3a25a353558a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "401c7e16-c5b6-491f-9022-5053f81730c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1cf25115-6b44-48af-bb60-992cf49b9647", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b4dc64ec-e1c2-4f67-b6df-8fb881b71d31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "95a7bf5b-83ee-4045-83c4-c71cb2499e87", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aed9444e-c540-42a0-9bc2-f94a6dd32b20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "11712548-564e-43a2-89c2-490a6920fce4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ebda2dfd-c48c-4a85-afb4-d4d97ee8bf37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c53c4cc4-f761-4176-8401-4f13bb82517b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "643c30fc-484c-4025-a1fc-dc0e266c1aed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "02543bbc-64ef-4f11-904d-873fc21474fb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "value": "3363" + }, + { + "description": "Motor Vehicle Gasoline Engine and Engine Parts Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5ef5cbc8-1134-4b45-bfde-c01a6f0f8896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "88eb9aaa-8e3b-4cb8-b150-16bb8ac58c45", + "value": "33631" + }, + { + "description": "Motor Vehicle Gasoline Engine and Engine Parts Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "88eb9aaa-8e3b-4cb8-b150-16bb8ac58c45", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5ef5cbc8-1134-4b45-bfde-c01a6f0f8896", + "value": "336310" + }, + { + "description": "Motor Vehicle Electrical and Electronic Equipment Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1ca18cf3-47c1-4376-804e-1a70a29e43d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bfbffc53-8828-4ec2-aded-653ceac8ea52", + "value": "33632" + }, + { + "description": "Motor Vehicle Electrical and Electronic Equipment Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bfbffc53-8828-4ec2-aded-653ceac8ea52", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1ca18cf3-47c1-4376-804e-1a70a29e43d7", + "value": "336320" + }, + { + "description": "Motor Vehicle Steering and Suspension Components (except Spring) Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fa6af269-a3fd-4a16-b5bd-3a25a353558a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "39d8ad0c-edbe-4584-9400-565b403485b9", + "value": "33633" + }, + { + "description": "Motor Vehicle Steering and Suspension Components (except Spring) Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "39d8ad0c-edbe-4584-9400-565b403485b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fa6af269-a3fd-4a16-b5bd-3a25a353558a", + "value": "336330" + }, + { + "description": "Motor Vehicle Brake System Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1cf25115-6b44-48af-bb60-992cf49b9647", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "401c7e16-c5b6-491f-9022-5053f81730c5", + "value": "33634" + }, + { + "description": "Motor Vehicle Brake System Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "401c7e16-c5b6-491f-9022-5053f81730c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1cf25115-6b44-48af-bb60-992cf49b9647", + "value": "336340" + }, + { + "description": "Motor Vehicle Transmission and Power Train Parts Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "95a7bf5b-83ee-4045-83c4-c71cb2499e87", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b4dc64ec-e1c2-4f67-b6df-8fb881b71d31", + "value": "33635" + }, + { + "description": "Motor Vehicle Transmission and Power Train Parts Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b4dc64ec-e1c2-4f67-b6df-8fb881b71d31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "95a7bf5b-83ee-4045-83c4-c71cb2499e87", + "value": "336350" + }, + { + "description": "Motor Vehicle Seating and Interior Trim Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "11712548-564e-43a2-89c2-490a6920fce4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "aed9444e-c540-42a0-9bc2-f94a6dd32b20", + "value": "33636" + }, + { + "description": "Motor Vehicle Seating and Interior Trim Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aed9444e-c540-42a0-9bc2-f94a6dd32b20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "11712548-564e-43a2-89c2-490a6920fce4", + "value": "336360" + }, + { + "description": "Motor Vehicle Metal Stamping", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c53c4cc4-f761-4176-8401-4f13bb82517b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ebda2dfd-c48c-4a85-afb4-d4d97ee8bf37", + "value": "33637" + }, + { + "description": "Motor Vehicle Metal Stamping", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ebda2dfd-c48c-4a85-afb4-d4d97ee8bf37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c53c4cc4-f761-4176-8401-4f13bb82517b", + "value": "336370" + }, + { + "description": "Other Motor Vehicle Parts Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "02543bbc-64ef-4f11-904d-873fc21474fb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "643c30fc-484c-4025-a1fc-dc0e266c1aed", + "value": "33639" + }, + { + "description": "Other Motor Vehicle Parts Manufacturing", + "related": [ + { + "dest-uuid": "5abee5f8-42e8-4e7e-93e3-99a88b32e631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "643c30fc-484c-4025-a1fc-dc0e266c1aed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "02543bbc-64ef-4f11-904d-873fc21474fb", + "value": "336390" + }, + { + "description": "Aerospace Product and Parts Manufacturing", + "related": [ + { + "dest-uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "64f175bb-ed69-4bf7-b752-01e7f3d6973a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "205f1ef8-30da-404d-9169-a89268d865c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0166fe2d-2aaa-48a9-a207-57ff271e9c80", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3ba7278d-06eb-4a10-add2-ba5cd2634a9b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4b77b750-5441-418c-96f5-e871a50aa548", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "94d08184-18cc-47a4-abd8-d493e04a7786", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "02e508c8-a964-41a1-baf1-1ac34101ac0b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "value": "3364" + }, + { + "description": "Aerospace Product and Parts Manufacturing", + "related": [ + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "64f175bb-ed69-4bf7-b752-01e7f3d6973a", + "value": "33641" + }, + { + "description": "Aircraft Manufacturing ", + "related": [ + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "205f1ef8-30da-404d-9169-a89268d865c9", + "value": "336411" + }, + { + "description": "Aircraft Engine and Engine Parts Manufacturing ", + "related": [ + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0166fe2d-2aaa-48a9-a207-57ff271e9c80", + "value": "336412" + }, + { + "description": "Other Aircraft Parts and Auxiliary Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3ba7278d-06eb-4a10-add2-ba5cd2634a9b", + "value": "336413" + }, + { + "description": "Guided Missile and Space Vehicle Manufacturing ", + "related": [ + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4b77b750-5441-418c-96f5-e871a50aa548", + "value": "336414" + }, + { + "description": "Guided Missile and Space Vehicle Propulsion Unit and Propulsion Unit Parts Manufacturing ", + "related": [ + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "94d08184-18cc-47a4-abd8-d493e04a7786", + "value": "336415" + }, + { + "description": "Other Guided Missile and Space Vehicle Parts and Auxiliary Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "02e508c8-a964-41a1-baf1-1ac34101ac0b", + "value": "336419" + }, + { + "description": "Railroad Rolling Stock Manufacturing", + "related": [ + { + "dest-uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "68e33b13-d358-438c-9c8c-f60b7f2e3440", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2707dfce-2acd-4491-a6cb-58dadd04016f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e944bc11-1db9-4953-baec-7f9f2955f337", + "value": "3365" + }, + { + "description": "Railroad Rolling Stock Manufacturing", + "related": [ + { + "dest-uuid": "e944bc11-1db9-4953-baec-7f9f2955f337", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2707dfce-2acd-4491-a6cb-58dadd04016f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "68e33b13-d358-438c-9c8c-f60b7f2e3440", + "value": "33651" + }, + { + "description": "Railroad Rolling Stock Manufacturing", + "related": [ + { + "dest-uuid": "e944bc11-1db9-4953-baec-7f9f2955f337", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "68e33b13-d358-438c-9c8c-f60b7f2e3440", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2707dfce-2acd-4491-a6cb-58dadd04016f", + "value": "336510" + }, + { + "description": "Ship and Boat Building", + "related": [ + { + "dest-uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ae92bd03-9317-4e33-8b70-e285bdfd159b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "17c04991-7b25-4cfd-80cc-ec95a5c1cb5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8e8bb5f6-c3ad-418c-9201-24ff26744b65", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b72788bd-024e-4ee3-9ca0-4b7b48960d21", + "value": "3366" + }, + { + "description": "Ship and Boat Building", + "related": [ + { + "dest-uuid": "b72788bd-024e-4ee3-9ca0-4b7b48960d21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ae92bd03-9317-4e33-8b70-e285bdfd159b", + "value": "33661" + }, + { + "description": "Ship Building and Repairing ", + "related": [ + { + "dest-uuid": "b72788bd-024e-4ee3-9ca0-4b7b48960d21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "17c04991-7b25-4cfd-80cc-ec95a5c1cb5d", + "value": "336611" + }, + { + "description": "Boat Building ", + "related": [ + { + "dest-uuid": "b72788bd-024e-4ee3-9ca0-4b7b48960d21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8e8bb5f6-c3ad-418c-9201-24ff26744b65", + "value": "336612" + }, + { + "description": "Other Transportation Equipment Manufacturing", + "related": [ + { + "dest-uuid": "c4cba133-23bd-4a17-bab2-8821293f65e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "12b284ee-c85f-4766-859d-b2cfecb4fd59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b0323caf-dd95-410f-b76e-5d0687eab546", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "89761b9d-fe4a-4b0f-98ee-01abc30639cb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "60e39012-659d-42da-8c32-045bacf9d54a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", + "value": "3369" + }, + { + "description": "Other Transportation Equipment Manufacturing", + "related": [ + { + "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "12b284ee-c85f-4766-859d-b2cfecb4fd59", + "value": "33699" + }, + { + "description": "Motorcycle, Bicycle, and Parts Manufacturing ", + "related": [ + { + "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b0323caf-dd95-410f-b76e-5d0687eab546", + "value": "336991" + }, + { + "description": "Military Armored Vehicle, Tank, and Tank Component Manufacturing ", + "related": [ + { + "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "89761b9d-fe4a-4b0f-98ee-01abc30639cb", + "value": "336992" + }, + { + "description": "All Other Transportation Equipment Manufacturing ", + "related": [ + { + "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "60e39012-659d-42da-8c32-045bacf9d54a", + "value": "336999" + }, + { + "description": "Furniture and Related Product Manufacturing", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a75be6e6-761c-4412-abec-80c6b3ae499c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e06b598a-b2b6-4fa6-8e5c-4e5bdaa7e0ed", + "value": "337" + }, + { + "description": "Household and Institutional Furniture and Kitchen Cabinet Manufacturing", + "related": [ + { + "dest-uuid": "e06b598a-b2b6-4fa6-8e5c-4e5bdaa7e0ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3b8bdcc7-8ad2-43fd-a5a6-7a0a35974f0f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "848a7e4d-9b49-487e-98f8-dd61bf00ebb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c97efec8-caf0-4143-a581-052e8e7e900a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a289e05d-09e7-4e49-9f63-4a34d3344b09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0731eec1-0661-43e5-80aa-f03692ce9c4c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "01c466e3-3f1e-4ea3-9adf-60217e0fbe41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fc08db75-cecb-485b-8cc7-5ec8c87d97b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "value": "3371" + }, + { + "description": "Wood Kitchen Cabinet and Countertop Manufacturing", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "848a7e4d-9b49-487e-98f8-dd61bf00ebb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3b8bdcc7-8ad2-43fd-a5a6-7a0a35974f0f", + "value": "33711" + }, + { + "description": "Wood Kitchen Cabinet and Countertop Manufacturing", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3b8bdcc7-8ad2-43fd-a5a6-7a0a35974f0f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "848a7e4d-9b49-487e-98f8-dd61bf00ebb8", + "value": "337110" + }, + { + "description": "Household and Institutional Furniture Manufacturing", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c97efec8-caf0-4143-a581-052e8e7e900a", + "value": "33712" + }, + { + "description": "Upholstered Household Furniture Manufacturing ", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a289e05d-09e7-4e49-9f63-4a34d3344b09", + "value": "337121" + }, + { + "description": "Nonupholstered Wood Household Furniture Manufacturing ", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0731eec1-0661-43e5-80aa-f03692ce9c4c", + "value": "337122" + }, + { + "description": "Household Furniture (except Wood and Upholstered) Manufacturing ", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "01c466e3-3f1e-4ea3-9adf-60217e0fbe41", + "value": "337126" + }, + { + "description": "Institutional Furniture Manufacturing ", + "related": [ + { + "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fc08db75-cecb-485b-8cc7-5ec8c87d97b1", + "value": "337127" + }, + { + "description": "Office Furniture (including Fixtures) Manufacturing", + "related": [ + { + "dest-uuid": "e06b598a-b2b6-4fa6-8e5c-4e5bdaa7e0ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cfd0075b-da4c-4b39-a6ac-949c0f1cd607", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f37ebe35-c973-4957-ab5e-b1a8537155d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4e5ea6ef-4144-4312-a4d2-c8b872f6d4fd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d367e3fe-9350-4345-a41a-72ebef16877b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "69db04e5-69c8-427b-9ba5-4d59f87db29f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", + "value": "3372" + }, + { + "description": "Office Furniture (including Fixtures) Manufacturing", + "related": [ + { + "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cfd0075b-da4c-4b39-a6ac-949c0f1cd607", + "value": "33721" + }, + { + "description": "Wood Office Furniture Manufacturing ", + "related": [ + { + "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f37ebe35-c973-4957-ab5e-b1a8537155d9", + "value": "337211" + }, + { + "description": "Custom Architectural Woodwork and Millwork Manufacturing ", + "related": [ + { + "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4e5ea6ef-4144-4312-a4d2-c8b872f6d4fd", + "value": "337212" + }, + { + "description": "Office Furniture (except Wood) Manufacturing ", + "related": [ + { + "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d367e3fe-9350-4345-a41a-72ebef16877b", + "value": "337214" + }, + { + "description": "Showcase, Partition, Shelving, and Locker Manufacturing ", + "related": [ + { + "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "69db04e5-69c8-427b-9ba5-4d59f87db29f", + "value": "337215" + }, + { + "description": "Other Furniture Related Product Manufacturing", + "related": [ + { + "dest-uuid": "e06b598a-b2b6-4fa6-8e5c-4e5bdaa7e0ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b8b6963e-3778-4055-94f0-d3feb225b842", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "face8516-828f-4073-a3b5-01ab573998e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f131b0cd-fa00-476d-97bc-e6327a0247bd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "35a3d4e2-66fc-473e-8c07-a3e65a9dfabe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a75be6e6-761c-4412-abec-80c6b3ae499c", + "value": "3379" + }, + { + "description": "Mattress Manufacturing", + "related": [ + { + "dest-uuid": "a75be6e6-761c-4412-abec-80c6b3ae499c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "face8516-828f-4073-a3b5-01ab573998e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b8b6963e-3778-4055-94f0-d3feb225b842", + "value": "33791" + }, + { + "description": "Mattress Manufacturing", + "related": [ + { + "dest-uuid": "a75be6e6-761c-4412-abec-80c6b3ae499c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b8b6963e-3778-4055-94f0-d3feb225b842", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "face8516-828f-4073-a3b5-01ab573998e9", + "value": "337910" + }, + { + "description": "Blind and Shade Manufacturing", + "related": [ + { + "dest-uuid": "a75be6e6-761c-4412-abec-80c6b3ae499c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "35a3d4e2-66fc-473e-8c07-a3e65a9dfabe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f131b0cd-fa00-476d-97bc-e6327a0247bd", + "value": "33792" + }, + { + "description": "Blind and Shade Manufacturing", + "related": [ + { + "dest-uuid": "a75be6e6-761c-4412-abec-80c6b3ae499c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f131b0cd-fa00-476d-97bc-e6327a0247bd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "35a3d4e2-66fc-473e-8c07-a3e65a9dfabe", + "value": "337920" + }, + { + "description": "Miscellaneous Manufacturing", + "related": [ + { + "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4917b98c-c0db-42fb-842a-ad8519a28e70", + "value": "339" + }, + { + "description": "Medical Equipment and Supplies Manufacturing", + "related": [ + { + "dest-uuid": "4917b98c-c0db-42fb-842a-ad8519a28e70", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "72ed97fb-5eed-4132-8a26-99e3cc658ed7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b5d6573e-a019-4c08-b226-61ec34fdc4a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a7487013-a110-4b10-a482-1e6c5a753bd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5de48e35-c2b5-4a2e-bd30-e2db7f1824b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "83a9bdda-2b79-4747-af7d-918fcd379cbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9a00efe5-2d26-4d69-8fc5-ebe53cbd3d57", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "value": "3391" + }, + { + "description": "Medical Equipment and Supplies Manufacturing", + "related": [ + { + "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "72ed97fb-5eed-4132-8a26-99e3cc658ed7", + "value": "33911" + }, + { + "description": "Surgical and Medical Instrument Manufacturing ", + "related": [ + { + "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b5d6573e-a019-4c08-b226-61ec34fdc4a6", + "value": "339112" + }, + { + "description": "Surgical Appliance and Supplies Manufacturing ", + "related": [ + { + "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a7487013-a110-4b10-a482-1e6c5a753bd4", + "value": "339113" + }, + { + "description": "Dental Equipment and Supplies Manufacturing ", + "related": [ + { + "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5de48e35-c2b5-4a2e-bd30-e2db7f1824b0", + "value": "339114" + }, + { + "description": "Ophthalmic Goods Manufacturing ", + "related": [ + { + "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "83a9bdda-2b79-4747-af7d-918fcd379cbf", + "value": "339115" + }, + { + "description": "Dental Laboratories ", + "related": [ + { + "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9a00efe5-2d26-4d69-8fc5-ebe53cbd3d57", + "value": "339116" + }, + { + "description": "Other Miscellaneous Manufacturing", + "related": [ + { + "dest-uuid": "4917b98c-c0db-42fb-842a-ad8519a28e70", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "95a493b5-6a72-4758-ba16-2ff87351b56c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fd037c05-5085-4221-9471-9f760e02144b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e6b5cd3d-70f3-4a84-8c4d-bd18023e9719", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c5d99f8f-81f0-4d45-95e5-fd6bf33b9887", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a2deeaf6-00bb-4ab6-8bbd-03e15e13950a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "872af48b-f026-4e48-9a39-4ef4b5dbac15", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "280fff7e-0d81-4809-8032-44cde80c80f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "62aad65b-daa6-453f-bf5f-b5b27acfb87e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d0911010-228d-4b73-b6ac-def0434079fd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1b05903c-ccc0-4e77-8951-66688662903c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4610dfa5-6241-414b-8c82-2553794ae852", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d79c358-519e-4ed0-893d-7c10825a9314", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "77ae33cd-ba8b-4ad5-be87-5f49f3dfbdb5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0fdb1da9-d939-46e6-8656-f651a336d031", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f2bb4f99-87b7-4fa0-b772-a3ef95a118fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1a3f324d-8e2c-4fac-b0b5-2030a1f82db0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "422af826-9fea-448d-b9f9-164cb6223117", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "value": "3399" + }, + { + "description": "Jewelry and Silverware Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd037c05-5085-4221-9471-9f760e02144b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "95a493b5-6a72-4758-ba16-2ff87351b56c", + "value": "33991" + }, + { + "description": "Jewelry and Silverware Manufacturing ", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "95a493b5-6a72-4758-ba16-2ff87351b56c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fd037c05-5085-4221-9471-9f760e02144b", + "value": "339910" + }, + { + "description": "Sporting and Athletic Goods Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c5d99f8f-81f0-4d45-95e5-fd6bf33b9887", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e6b5cd3d-70f3-4a84-8c4d-bd18023e9719", + "value": "33992" + }, + { + "description": "Sporting and Athletic Goods Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e6b5cd3d-70f3-4a84-8c4d-bd18023e9719", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c5d99f8f-81f0-4d45-95e5-fd6bf33b9887", + "value": "339920" + }, + { + "description": "Doll, Toy, and Game Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "872af48b-f026-4e48-9a39-4ef4b5dbac15", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a2deeaf6-00bb-4ab6-8bbd-03e15e13950a", + "value": "33993" + }, + { + "description": "Doll, Toy, and Game Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a2deeaf6-00bb-4ab6-8bbd-03e15e13950a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "872af48b-f026-4e48-9a39-4ef4b5dbac15", + "value": "339930" + }, + { + "description": "Office Supplies (except Paper) Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "62aad65b-daa6-453f-bf5f-b5b27acfb87e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "280fff7e-0d81-4809-8032-44cde80c80f3", + "value": "33994" + }, + { + "description": "Office Supplies (except Paper) Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "280fff7e-0d81-4809-8032-44cde80c80f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "62aad65b-daa6-453f-bf5f-b5b27acfb87e", + "value": "339940" + }, + { + "description": "Sign Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1b05903c-ccc0-4e77-8951-66688662903c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d0911010-228d-4b73-b6ac-def0434079fd", + "value": "33995" + }, + { + "description": "Sign Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d0911010-228d-4b73-b6ac-def0434079fd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1b05903c-ccc0-4e77-8951-66688662903c", + "value": "339950" + }, + { + "description": "All Other Miscellaneous Manufacturing", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4610dfa5-6241-414b-8c82-2553794ae852", + "value": "33999" + }, + { + "description": "Gasket, Packing, and Sealing Device Manufacturing ", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3d79c358-519e-4ed0-893d-7c10825a9314", + "value": "339991" + }, + { + "description": "Musical Instrument Manufacturing ", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "77ae33cd-ba8b-4ad5-be87-5f49f3dfbdb5", + "value": "339992" + }, + { + "description": "Fastener, Button, Needle, and Pin Manufacturing ", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0fdb1da9-d939-46e6-8656-f651a336d031", + "value": "339993" + }, + { + "description": "Broom, Brush, and Mop Manufacturing ", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f2bb4f99-87b7-4fa0-b772-a3ef95a118fa", + "value": "339994" + }, + { + "description": "Burial Casket Manufacturing ", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1a3f324d-8e2c-4fac-b0b5-2030a1f82db0", + "value": "339995" + }, + { + "description": "All Other Miscellaneous Manufacturing ", + "related": [ + { + "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "422af826-9fea-448d-b9f9-164cb6223117", + "value": "339999" + }, + { + "description": "Wholesale Trade", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0efc2b37-40d3-4296-9fc0-3b3f40b224ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "263d2cb5-c44f-4fb5-a5a1-b940375f7a5a", + "value": "42" + }, + { + "description": "Merchant Wholesalers, Durable Goods ", + "related": [ + { + "dest-uuid": "263d2cb5-c44f-4fb5-a5a1-b940375f7a5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "value": "423" + }, + { + "description": "Motor Vehicle and Motor Vehicle Parts and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1baadf2d-f3a4-41da-a0ef-451ddb761da3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d3babff6-8fbe-4abf-a804-aca497f61378", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f1699020-fc83-4a77-96de-dc129dfafcfc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "301d5eb0-5076-4116-9ea0-34eae5f4a741", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9dd8bfc1-1b07-42f6-9447-8c2ae79380ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4b85d082-1054-4cb6-8606-b6b783c4ba8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2023b66f-3720-434a-924c-16d7cc7695ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5cefb76b-f48d-4197-9f30-42061f4e37d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "value": "4231" + }, + { + "description": "Automobile and Other Motor Vehicle Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d3babff6-8fbe-4abf-a804-aca497f61378", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1baadf2d-f3a4-41da-a0ef-451ddb761da3", + "value": "42311" + }, + { + "description": "Automobile and Other Motor Vehicle Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1baadf2d-f3a4-41da-a0ef-451ddb761da3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d3babff6-8fbe-4abf-a804-aca497f61378", + "value": "423110" + }, + { + "description": "Motor Vehicle Supplies and New Parts Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "301d5eb0-5076-4116-9ea0-34eae5f4a741", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f1699020-fc83-4a77-96de-dc129dfafcfc", + "value": "42312" + }, + { + "description": "Motor Vehicle Supplies and New Parts Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f1699020-fc83-4a77-96de-dc129dfafcfc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "301d5eb0-5076-4116-9ea0-34eae5f4a741", + "value": "423120" + }, + { + "description": "Tire and Tube Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4b85d082-1054-4cb6-8606-b6b783c4ba8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9dd8bfc1-1b07-42f6-9447-8c2ae79380ab", + "value": "42313" + }, + { + "description": "Tire and Tube Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9dd8bfc1-1b07-42f6-9447-8c2ae79380ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4b85d082-1054-4cb6-8606-b6b783c4ba8e", + "value": "423130" + }, + { + "description": "Motor Vehicle Parts (Used) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5cefb76b-f48d-4197-9f30-42061f4e37d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2023b66f-3720-434a-924c-16d7cc7695ef", + "value": "42314" + }, + { + "description": "Motor Vehicle Parts (Used) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2023b66f-3720-434a-924c-16d7cc7695ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5cefb76b-f48d-4197-9f30-42061f4e37d3", + "value": "423140" + }, + { + "description": "Furniture and Home Furnishing Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "26d9a80a-51b4-4d3c-b680-eb2abbc311fe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e7bf4880-32f3-4652-b6d1-841f0e339235", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "54e382c8-d662-4e45-a24a-89cefa7aaac1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dcd0c4d1-3abc-4373-ae33-57a179392114", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", + "value": "4232" + }, + { + "description": "Furniture Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e7bf4880-32f3-4652-b6d1-841f0e339235", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "26d9a80a-51b4-4d3c-b680-eb2abbc311fe", + "value": "42321" + }, + { + "description": "Furniture Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "26d9a80a-51b4-4d3c-b680-eb2abbc311fe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e7bf4880-32f3-4652-b6d1-841f0e339235", + "value": "423210" + }, + { + "description": "Home Furnishing Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dcd0c4d1-3abc-4373-ae33-57a179392114", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "54e382c8-d662-4e45-a24a-89cefa7aaac1", + "value": "42322" + }, + { + "description": "Home Furnishing Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "54e382c8-d662-4e45-a24a-89cefa7aaac1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dcd0c4d1-3abc-4373-ae33-57a179392114", + "value": "423220" + }, + { + "description": "Lumber and Other Construction Materials Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dea88c03-dafb-42f9-8997-19fb725e6ec2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cd7e72a5-0495-4e0c-88a2-b498c90fcaa5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dafefcc1-2574-40e1-9dff-5733a9dc36cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5bea7ec5-699b-4fdb-a33d-cb2321218472", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e543a0d9-9ebc-4e8a-ada4-d81d9153a20d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "caeb9ebd-ccc7-414e-aca4-adf15c9907eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "35d03629-187f-4f18-9a4b-8330f1d8fa8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e337a8bc-87e7-4629-8b87-f1109f8b8d93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "value": "4233" + }, + { + "description": "Lumber, Plywood, Millwork, and Wood Panel Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cd7e72a5-0495-4e0c-88a2-b498c90fcaa5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dea88c03-dafb-42f9-8997-19fb725e6ec2", + "value": "42331" + }, + { + "description": "Lumber, Plywood, Millwork, and Wood Panel Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dea88c03-dafb-42f9-8997-19fb725e6ec2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cd7e72a5-0495-4e0c-88a2-b498c90fcaa5", + "value": "423310" + }, + { + "description": "Brick, Stone, and Related Construction Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5bea7ec5-699b-4fdb-a33d-cb2321218472", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dafefcc1-2574-40e1-9dff-5733a9dc36cc", + "value": "42332" + }, + { + "description": "Brick, Stone, and Related Construction Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dafefcc1-2574-40e1-9dff-5733a9dc36cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5bea7ec5-699b-4fdb-a33d-cb2321218472", + "value": "423320" + }, + { + "description": "Roofing, Siding, and Insulation Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "caeb9ebd-ccc7-414e-aca4-adf15c9907eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e543a0d9-9ebc-4e8a-ada4-d81d9153a20d", + "value": "42333" + }, + { + "description": "Roofing, Siding, and Insulation Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e543a0d9-9ebc-4e8a-ada4-d81d9153a20d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "caeb9ebd-ccc7-414e-aca4-adf15c9907eb", + "value": "423330" + }, + { + "description": "Other Construction Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e337a8bc-87e7-4629-8b87-f1109f8b8d93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "35d03629-187f-4f18-9a4b-8330f1d8fa8f", + "value": "42339" + }, + { + "description": "Other Construction Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "35d03629-187f-4f18-9a4b-8330f1d8fa8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e337a8bc-87e7-4629-8b87-f1109f8b8d93", + "value": "423390" + }, + { + "description": "Professional and Commercial Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c9fe770-d2e0-499c-bdc5-b9d7c0e956a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "61e7f22c-f2b9-4069-982c-a8cc3ccb1c7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "90f2826e-2e89-4eab-9f87-f1479f78f07b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ba24ff7c-ccdd-40e7-b791-545650370d28", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7599ef24-703c-44a1-88d6-96de8ccb1ee4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d9af2d09-0a39-4dcf-991a-9e6942d93ef0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f2da763d-0a6f-4da7-9fbc-31f4d23dbb3c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce2d0663-6611-4e95-bef9-b5ebd742c564", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "546a4ffd-a283-478f-8ddd-02db304970d2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a164f29f-7463-48b4-9716-389d2778bd8d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a6aa2b73-780f-48a2-91fb-bd2a2dbba49a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a231511e-8954-4232-906c-c799915ae8a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "76f9422f-02d9-43af-a6ce-8ab16d1e8186", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e4f45ac5-b5a2-419d-baf8-819c935de43b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "value": "4234" + }, + { + "description": "Photographic Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "61e7f22c-f2b9-4069-982c-a8cc3ccb1c7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c9fe770-d2e0-499c-bdc5-b9d7c0e956a0", + "value": "42341" + }, + { + "description": "Photographic Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c9fe770-d2e0-499c-bdc5-b9d7c0e956a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "61e7f22c-f2b9-4069-982c-a8cc3ccb1c7c", + "value": "423410" + }, + { + "description": "Office Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ba24ff7c-ccdd-40e7-b791-545650370d28", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "90f2826e-2e89-4eab-9f87-f1479f78f07b", + "value": "42342" + }, + { + "description": "Office Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90f2826e-2e89-4eab-9f87-f1479f78f07b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ba24ff7c-ccdd-40e7-b791-545650370d28", + "value": "423420" + }, + { + "description": "Computer and Computer Peripheral Equipment and Software Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d9af2d09-0a39-4dcf-991a-9e6942d93ef0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7599ef24-703c-44a1-88d6-96de8ccb1ee4", + "value": "42343" + }, + { + "description": "Computer and Computer Peripheral Equipment and Software Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7599ef24-703c-44a1-88d6-96de8ccb1ee4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d9af2d09-0a39-4dcf-991a-9e6942d93ef0", + "value": "423430" + }, + { + "description": "Other Commercial Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ce2d0663-6611-4e95-bef9-b5ebd742c564", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f2da763d-0a6f-4da7-9fbc-31f4d23dbb3c", + "value": "42344" + }, + { + "description": "Other Commercial Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f2da763d-0a6f-4da7-9fbc-31f4d23dbb3c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ce2d0663-6611-4e95-bef9-b5ebd742c564", + "value": "423440" + }, + { + "description": "Medical, Dental, and Hospital Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a164f29f-7463-48b4-9716-389d2778bd8d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "546a4ffd-a283-478f-8ddd-02db304970d2", + "value": "42345" + }, + { + "description": "Medical, Dental, and Hospital Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "546a4ffd-a283-478f-8ddd-02db304970d2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a164f29f-7463-48b4-9716-389d2778bd8d", + "value": "423450" + }, + { + "description": "Ophthalmic Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a231511e-8954-4232-906c-c799915ae8a6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a6aa2b73-780f-48a2-91fb-bd2a2dbba49a", + "value": "42346" + }, + { + "description": "Ophthalmic Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a6aa2b73-780f-48a2-91fb-bd2a2dbba49a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a231511e-8954-4232-906c-c799915ae8a6", + "value": "423460" + }, + { + "description": "Other Professional Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e4f45ac5-b5a2-419d-baf8-819c935de43b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "76f9422f-02d9-43af-a6ce-8ab16d1e8186", + "value": "42349" + }, + { + "description": "Other Professional Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "76f9422f-02d9-43af-a6ce-8ab16d1e8186", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e4f45ac5-b5a2-419d-baf8-819c935de43b", + "value": "423490" + }, + { + "description": "Metal and Mineral (except Petroleum) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9e7234d2-640c-4c35-ac8d-edf60d11b04e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "03249ee4-3e89-4851-baf9-2deb168bf06c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "92c0883b-6ae2-42b7-bfd6-7196144fc6ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "45729922-e9b4-4d7a-9908-5b9521cdfc17", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", + "value": "4235" + }, + { + "description": "Metal Service Centers and Other Metal Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "03249ee4-3e89-4851-baf9-2deb168bf06c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9e7234d2-640c-4c35-ac8d-edf60d11b04e", + "value": "42351" + }, + { + "description": "Metal Service Centers and Other Metal Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9e7234d2-640c-4c35-ac8d-edf60d11b04e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "03249ee4-3e89-4851-baf9-2deb168bf06c", + "value": "423510" + }, + { + "description": "Coal and Other Mineral and Ore Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "45729922-e9b4-4d7a-9908-5b9521cdfc17", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "92c0883b-6ae2-42b7-bfd6-7196144fc6ff", + "value": "42352" + }, + { + "description": "Coal and Other Mineral and Ore Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "92c0883b-6ae2-42b7-bfd6-7196144fc6ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "45729922-e9b4-4d7a-9908-5b9521cdfc17", + "value": "423520" + }, + { + "description": "Household Appliances and Electrical and Electronic Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ec2d8646-f918-423a-92f5-c62ce3434ac8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "61f172cc-a205-4681-bba7-d8fc47cb7869", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e0f52c6d-8378-45ba-a3fd-083b804223a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "81553a1e-1922-401f-8da5-49bdbfc6bab1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2fd38b82-6e92-46b8-b71a-1dee59fd52eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cb75140b-8f67-4fb0-b6c6-7a737b8cbee4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "value": "4236" + }, + { + "description": "Electrical Apparatus and Equipment, Wiring Supplies, and Related Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "61f172cc-a205-4681-bba7-d8fc47cb7869", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ec2d8646-f918-423a-92f5-c62ce3434ac8", + "value": "42361" + }, + { + "description": "Electrical Apparatus and Equipment, Wiring Supplies, and Related Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ec2d8646-f918-423a-92f5-c62ce3434ac8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "61f172cc-a205-4681-bba7-d8fc47cb7869", + "value": "423610" + }, + { + "description": "Household Appliances, Electric Housewares, and Consumer Electronics Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "81553a1e-1922-401f-8da5-49bdbfc6bab1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e0f52c6d-8378-45ba-a3fd-083b804223a7", + "value": "42362" + }, + { + "description": "Household Appliances, Electric Housewares, and Consumer Electronics Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e0f52c6d-8378-45ba-a3fd-083b804223a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "81553a1e-1922-401f-8da5-49bdbfc6bab1", + "value": "423620" + }, + { + "description": "Other Electronic Parts and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cb75140b-8f67-4fb0-b6c6-7a737b8cbee4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2fd38b82-6e92-46b8-b71a-1dee59fd52eb", + "value": "42369" + }, + { + "description": "Other Electronic Parts and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2fd38b82-6e92-46b8-b71a-1dee59fd52eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cb75140b-8f67-4fb0-b6c6-7a737b8cbee4", + "value": "423690" + }, + { + "description": "Hardware, and Plumbing and Heating Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7873d67f-7192-4d8f-a371-78a486407f98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2225ae3c-226d-482d-a911-73ccf7442c88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1f2eb10f-511e-4b9f-9729-74664434ad04", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "92111d68-e048-4586-84da-ce3bb799d402", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b74072ec-c0a7-407f-a565-b2b0bc00478c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f5a0bc06-c39a-4179-a84d-51156116cfdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e66c25eb-469c-412c-8114-7ff62af88038", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f98d6e1c-b731-4531-a615-f68aa3f21a3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "value": "4237" + }, + { + "description": "Hardware Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2225ae3c-226d-482d-a911-73ccf7442c88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7873d67f-7192-4d8f-a371-78a486407f98", + "value": "42371" + }, + { + "description": "Hardware Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7873d67f-7192-4d8f-a371-78a486407f98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2225ae3c-226d-482d-a911-73ccf7442c88", + "value": "423710" + }, + { + "description": "Plumbing and Heating Equipment and Supplies (Hydronics) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "92111d68-e048-4586-84da-ce3bb799d402", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1f2eb10f-511e-4b9f-9729-74664434ad04", + "value": "42372" + }, + { + "description": "Plumbing and Heating Equipment and Supplies (Hydronics) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1f2eb10f-511e-4b9f-9729-74664434ad04", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "92111d68-e048-4586-84da-ce3bb799d402", + "value": "423720" + }, + { + "description": "Warm Air Heating and Air-Conditioning Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f5a0bc06-c39a-4179-a84d-51156116cfdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b74072ec-c0a7-407f-a565-b2b0bc00478c", + "value": "42373" + }, + { + "description": "Warm Air Heating and Air-Conditioning Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b74072ec-c0a7-407f-a565-b2b0bc00478c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f5a0bc06-c39a-4179-a84d-51156116cfdf", + "value": "423730" + }, + { + "description": "Refrigeration Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f98d6e1c-b731-4531-a615-f68aa3f21a3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e66c25eb-469c-412c-8114-7ff62af88038", + "value": "42374" + }, + { + "description": "Refrigeration Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e66c25eb-469c-412c-8114-7ff62af88038", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f98d6e1c-b731-4531-a615-f68aa3f21a3d", + "value": "423740" + }, + { + "description": "Machinery, Equipment, and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "815d478c-c4b3-4ff4-a569-dbbe6087e4ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1a516d8-281a-44e5-9331-cc4cc14a0714", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bc2b5462-9652-4d9b-b2da-63df7e70884a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6a73a564-96aa-4441-ae8a-cf01a4db410a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0c4aa92f-27e6-48b5-b9d6-b45b75965ee4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ea85e7e5-27e8-4932-a710-aba46da2d437", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c594c765-c70d-4387-84cb-f0c29901d79e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6b6a118d-ac61-4b35-97cc-02e3eeb25b06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e06fb0ce-df81-4013-a819-7575be89a200", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "02dd3967-ec35-4ea4-9025-c6a94c851c9a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bf1c9281-74d8-4f79-8b18-ff924abb680e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0d1bb807-80e9-4fa9-ba23-6e2e9a5d08a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "value": "4238" + }, + { + "description": "Construction and Mining (except Oil Well) Machinery and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c1a516d8-281a-44e5-9331-cc4cc14a0714", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "815d478c-c4b3-4ff4-a569-dbbe6087e4ea", + "value": "42381" + }, + { + "description": "Construction and Mining (except Oil Well) Machinery and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "815d478c-c4b3-4ff4-a569-dbbe6087e4ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c1a516d8-281a-44e5-9331-cc4cc14a0714", + "value": "423810" + }, + { + "description": "Farm and Garden Machinery and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6a73a564-96aa-4441-ae8a-cf01a4db410a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bc2b5462-9652-4d9b-b2da-63df7e70884a", + "value": "42382" + }, + { + "description": "Farm and Garden Machinery and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bc2b5462-9652-4d9b-b2da-63df7e70884a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6a73a564-96aa-4441-ae8a-cf01a4db410a", + "value": "423820" + }, + { + "description": "Industrial Machinery and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ea85e7e5-27e8-4932-a710-aba46da2d437", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0c4aa92f-27e6-48b5-b9d6-b45b75965ee4", + "value": "42383" + }, + { + "description": "Industrial Machinery and Equipment Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0c4aa92f-27e6-48b5-b9d6-b45b75965ee4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ea85e7e5-27e8-4932-a710-aba46da2d437", + "value": "423830" + }, + { + "description": "Industrial Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6b6a118d-ac61-4b35-97cc-02e3eeb25b06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c594c765-c70d-4387-84cb-f0c29901d79e", + "value": "42384" + }, + { + "description": "Industrial Supplies Merchant Wholesalers", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c594c765-c70d-4387-84cb-f0c29901d79e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6b6a118d-ac61-4b35-97cc-02e3eeb25b06", + "value": "423840" + }, + { + "description": "Service Establishment Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "02dd3967-ec35-4ea4-9025-c6a94c851c9a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e06fb0ce-df81-4013-a819-7575be89a200", + "value": "42385" + }, + { + "description": "Service Establishment Equipment and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e06fb0ce-df81-4013-a819-7575be89a200", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "02dd3967-ec35-4ea4-9025-c6a94c851c9a", + "value": "423850" + }, + { + "description": "Transportation Equipment and Supplies (except Motor Vehicle) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0d1bb807-80e9-4fa9-ba23-6e2e9a5d08a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bf1c9281-74d8-4f79-8b18-ff924abb680e", + "value": "42386" + }, + { + "description": "Transportation Equipment and Supplies (except Motor Vehicle) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bf1c9281-74d8-4f79-8b18-ff924abb680e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0d1bb807-80e9-4fa9-ba23-6e2e9a5d08a8", + "value": "423860" + }, + { + "description": "Miscellaneous Durable Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd229859-8061-47ff-b0e8-376a99c48f06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0da75265-490b-41fb-8ae1-c2b14c852f7e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a57e4fa8-1de0-45a4-a0af-8463427a8445", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9f38062d-e862-4649-af9c-00a517e1b728", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0bba0e0c-27c5-47f2-9bf0-9438b11b6562", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8886b56c-fdeb-43c4-b58b-587422577717", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aef9c613-3a6a-4706-956a-dd13afe76922", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e2583000-24b5-4dad-9588-0b16ff8b3337", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f57ecc9d-9a06-48d0-a8ba-15d3340b05f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "205e6cee-234d-4c53-ac3d-3769f16c96a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "value": "4239" + }, + { + "description": "Sporting and Recreational Goods and Supplies Merchant Wholesalers", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0da75265-490b-41fb-8ae1-c2b14c852f7e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fd229859-8061-47ff-b0e8-376a99c48f06", + "value": "42391" + }, + { + "description": "Sporting and Recreational Goods and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd229859-8061-47ff-b0e8-376a99c48f06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0da75265-490b-41fb-8ae1-c2b14c852f7e", + "value": "423910" + }, + { + "description": "Toy and Hobby Goods and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9f38062d-e862-4649-af9c-00a517e1b728", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a57e4fa8-1de0-45a4-a0af-8463427a8445", + "value": "42392" + }, + { + "description": "Toy and Hobby Goods and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a57e4fa8-1de0-45a4-a0af-8463427a8445", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9f38062d-e862-4649-af9c-00a517e1b728", + "value": "423920" + }, + { + "description": "Recyclable Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8886b56c-fdeb-43c4-b58b-587422577717", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0bba0e0c-27c5-47f2-9bf0-9438b11b6562", + "value": "42393" + }, + { + "description": "Recyclable Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0bba0e0c-27c5-47f2-9bf0-9438b11b6562", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8886b56c-fdeb-43c4-b58b-587422577717", + "value": "423930" + }, + { + "description": "Jewelry, Watch, Precious Stone, and Precious Metal Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e2583000-24b5-4dad-9588-0b16ff8b3337", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "aef9c613-3a6a-4706-956a-dd13afe76922", + "value": "42394" + }, + { + "description": "Jewelry, Watch, Precious Stone, and Precious Metal Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aef9c613-3a6a-4706-956a-dd13afe76922", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e2583000-24b5-4dad-9588-0b16ff8b3337", + "value": "423940" + }, + { + "description": "Other Miscellaneous Durable Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "205e6cee-234d-4c53-ac3d-3769f16c96a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f57ecc9d-9a06-48d0-a8ba-15d3340b05f4", + "value": "42399" + }, + { + "description": "Other Miscellaneous Durable Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f57ecc9d-9a06-48d0-a8ba-15d3340b05f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "205e6cee-234d-4c53-ac3d-3769f16c96a8", + "value": "423990" + }, + { + "description": "Merchant Wholesalers, Nondurable Goods ", + "related": [ + { + "dest-uuid": "263d2cb5-c44f-4fb5-a5a1-b940375f7a5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "56a85050-c5ec-4948-9470-685b22c04d49", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "value": "424" + }, + { + "description": "Paper and Paper Product Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "218f45d9-658d-4c3f-b950-4c2db10d8bdd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "30170360-0762-4f1c-86f4-4352a8fbbdb4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1688eba1-20cd-4ab0-823f-0a0396736920", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "459f98df-dfb2-4d1f-9afe-868ed79d4408", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "83445f28-0fcf-41b1-bef7-60aca537d783", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b3dc3a67-c890-42a1-9cf7-d61d14610cb2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "value": "4241" + }, + { + "description": "Printing and Writing Paper Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "30170360-0762-4f1c-86f4-4352a8fbbdb4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "218f45d9-658d-4c3f-b950-4c2db10d8bdd", + "value": "42411" + }, + { + "description": "Printing and Writing Paper Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "218f45d9-658d-4c3f-b950-4c2db10d8bdd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "30170360-0762-4f1c-86f4-4352a8fbbdb4", + "value": "424110" + }, + { + "description": "Stationery and Office Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "459f98df-dfb2-4d1f-9afe-868ed79d4408", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1688eba1-20cd-4ab0-823f-0a0396736920", + "value": "42412" + }, + { + "description": "Stationery and Office Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1688eba1-20cd-4ab0-823f-0a0396736920", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "459f98df-dfb2-4d1f-9afe-868ed79d4408", + "value": "424120" + }, + { + "description": "Industrial and Personal Service Paper Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b3dc3a67-c890-42a1-9cf7-d61d14610cb2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "83445f28-0fcf-41b1-bef7-60aca537d783", + "value": "42413" + }, + { + "description": "Industrial and Personal Service Paper Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "83445f28-0fcf-41b1-bef7-60aca537d783", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b3dc3a67-c890-42a1-9cf7-d61d14610cb2", + "value": "424130" + }, + { + "description": "Drugs and Druggists' Sundries Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4562a8d8-b722-42b0-8df5-95bef7ff4c41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5b7730b0-170d-4df9-97e0-b169b5bdc188", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "56a85050-c5ec-4948-9470-685b22c04d49", + "value": "4242" + }, + { + "description": "Drugs and Druggists' Sundries Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "56a85050-c5ec-4948-9470-685b22c04d49", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5b7730b0-170d-4df9-97e0-b169b5bdc188", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4562a8d8-b722-42b0-8df5-95bef7ff4c41", + "value": "42421" + }, + { + "description": "Drugs and Druggists' Sundries Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "56a85050-c5ec-4948-9470-685b22c04d49", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4562a8d8-b722-42b0-8df5-95bef7ff4c41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5b7730b0-170d-4df9-97e0-b169b5bdc188", + "value": "424210" + }, + { + "description": "Apparel, Piece Goods, and Notions Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "241935dd-971a-4f89-9fab-f843bb308165", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eba2f9f3-6f24-4b62-b63f-5e194075a4e0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6762a5ac-4910-4a7c-9573-cddaf45ff489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "035c43cc-409f-481e-9075-d57e8e98e50e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "297a546e-a53c-4c12-953d-77a38b3a713c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e4b8eedf-a0ba-4e9e-b5f0-ab66a442936f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "value": "4243" + }, + { + "description": "Piece Goods, Notions, and Other Dry Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eba2f9f3-6f24-4b62-b63f-5e194075a4e0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "241935dd-971a-4f89-9fab-f843bb308165", + "value": "42431" + }, + { + "description": "Piece Goods, Notions, and Other Dry Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "241935dd-971a-4f89-9fab-f843bb308165", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eba2f9f3-6f24-4b62-b63f-5e194075a4e0", + "value": "424310" + }, + { + "description": "Footwear Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "035c43cc-409f-481e-9075-d57e8e98e50e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6762a5ac-4910-4a7c-9573-cddaf45ff489", + "value": "42434" + }, + { + "description": "Footwear Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6762a5ac-4910-4a7c-9573-cddaf45ff489", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "035c43cc-409f-481e-9075-d57e8e98e50e", + "value": "424340" + }, + { + "description": "Clothing and Clothing Accessories Merchant Wholesalers", + "related": [ + { + "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e4b8eedf-a0ba-4e9e-b5f0-ab66a442936f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "297a546e-a53c-4c12-953d-77a38b3a713c", + "value": "42435" + }, + { + "description": "Clothing and Clothing Accessories Merchant Wholesalers", + "related": [ + { + "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "297a546e-a53c-4c12-953d-77a38b3a713c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e4b8eedf-a0ba-4e9e-b5f0-ab66a442936f", + "value": "424350" + }, + { + "description": "Grocery and Related Product Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "312ee642-2abe-43b9-8a18-890bf192e4fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5f3b19ff-93dd-4e9c-92ad-8e9984d2f3ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f7e4f202-d9af-4395-a0e3-2462b0e22015", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c15c24a-246b-4fe6-977a-fad9edeb926b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3f9e55f5-461d-43c6-8ad8-56325fc44873", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cafe4ff2-a8c0-4f07-8d1a-ed3fbc53e1b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e931fe04-9a4f-44a2-b85f-6c4678562619", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c45e6639-f91c-432b-b455-6305b63df3b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e37aea50-1613-421e-b249-0dd3a1ac068e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "231da8e8-646a-4995-bcf6-67401b86e7bc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "314acde1-09de-4e6c-ba32-eb5d82783af4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "35f8e1ad-1f62-45e7-9c89-2c5a1ac189e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ca23615e-eb4a-48bf-a43c-eb5f62ec37a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "de94f883-0f0b-440b-b112-3fb096a34652", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fbfbdbd1-6170-4609-a007-ec5489d734e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9f660aa8-752b-4cb9-aaf9-f33985ddf65f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "66b5d4cf-9d80-44bf-83eb-12b764ba6e0f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "90368199-5a43-41d0-bac2-02c93af4db68", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "value": "4244" + }, + { + "description": "General Line Grocery Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5f3b19ff-93dd-4e9c-92ad-8e9984d2f3ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "312ee642-2abe-43b9-8a18-890bf192e4fc", + "value": "42441" + }, + { + "description": "General Line Grocery Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "312ee642-2abe-43b9-8a18-890bf192e4fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5f3b19ff-93dd-4e9c-92ad-8e9984d2f3ef", + "value": "424410" + }, + { + "description": "Packaged Frozen Food Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c15c24a-246b-4fe6-977a-fad9edeb926b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f7e4f202-d9af-4395-a0e3-2462b0e22015", + "value": "42442" + }, + { + "description": "Packaged Frozen Food Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f7e4f202-d9af-4395-a0e3-2462b0e22015", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c15c24a-246b-4fe6-977a-fad9edeb926b", + "value": "424420" + }, + { + "description": "Dairy Product (except Dried or Canned) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cafe4ff2-a8c0-4f07-8d1a-ed3fbc53e1b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3f9e55f5-461d-43c6-8ad8-56325fc44873", + "value": "42443" + }, + { + "description": "Dairy Product (except Dried or Canned) Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3f9e55f5-461d-43c6-8ad8-56325fc44873", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cafe4ff2-a8c0-4f07-8d1a-ed3fbc53e1b2", + "value": "424430" + }, + { + "description": "Poultry and Poultry Product Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c45e6639-f91c-432b-b455-6305b63df3b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e931fe04-9a4f-44a2-b85f-6c4678562619", + "value": "42444" + }, + { + "description": "Poultry and Poultry Product Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e931fe04-9a4f-44a2-b85f-6c4678562619", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c45e6639-f91c-432b-b455-6305b63df3b6", + "value": "424440" + }, + { + "description": "Confectionery Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "231da8e8-646a-4995-bcf6-67401b86e7bc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e37aea50-1613-421e-b249-0dd3a1ac068e", + "value": "42445" + }, + { + "description": "Confectionery Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e37aea50-1613-421e-b249-0dd3a1ac068e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "231da8e8-646a-4995-bcf6-67401b86e7bc", + "value": "424450" + }, + { + "description": "Fish and Seafood Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "35f8e1ad-1f62-45e7-9c89-2c5a1ac189e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "314acde1-09de-4e6c-ba32-eb5d82783af4", + "value": "42446" + }, + { + "description": "Fish and Seafood Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "314acde1-09de-4e6c-ba32-eb5d82783af4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "35f8e1ad-1f62-45e7-9c89-2c5a1ac189e6", + "value": "424460" + }, + { + "description": "Meat and Meat Product Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "de94f883-0f0b-440b-b112-3fb096a34652", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ca23615e-eb4a-48bf-a43c-eb5f62ec37a8", + "value": "42447" + }, + { + "description": "Meat and Meat Product Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ca23615e-eb4a-48bf-a43c-eb5f62ec37a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "de94f883-0f0b-440b-b112-3fb096a34652", + "value": "424470" + }, + { + "description": "Fresh Fruit and Vegetable Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9f660aa8-752b-4cb9-aaf9-f33985ddf65f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fbfbdbd1-6170-4609-a007-ec5489d734e5", + "value": "42448" + }, + { + "description": "Fresh Fruit and Vegetable Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fbfbdbd1-6170-4609-a007-ec5489d734e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9f660aa8-752b-4cb9-aaf9-f33985ddf65f", + "value": "424480" + }, + { + "description": "Other Grocery and Related Products Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90368199-5a43-41d0-bac2-02c93af4db68", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "66b5d4cf-9d80-44bf-83eb-12b764ba6e0f", + "value": "42449" + }, + { + "description": "Other Grocery and Related Products Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "66b5d4cf-9d80-44bf-83eb-12b764ba6e0f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "90368199-5a43-41d0-bac2-02c93af4db68", + "value": "424490" + }, + { + "description": "Farm Product Raw Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2986bb3b-a159-4afe-b466-0ef618bf5f58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "03621ae4-16ed-4f8e-ace3-d302c568fe7d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ff09a197-fd6e-4392-89cd-21811a1a1e36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d067d90e-c9f3-413d-a9d1-ecb147bfee50", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d3073a25-e0a3-4d83-bd0a-4aa9db8de291", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "735ffdaf-40be-4a44-ba15-0b395913973d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "value": "4245" + }, + { + "description": "Grain and Field Bean Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "03621ae4-16ed-4f8e-ace3-d302c568fe7d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2986bb3b-a159-4afe-b466-0ef618bf5f58", + "value": "42451" + }, + { + "description": "Grain and Field Bean Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2986bb3b-a159-4afe-b466-0ef618bf5f58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "03621ae4-16ed-4f8e-ace3-d302c568fe7d", + "value": "424510" + }, + { + "description": "Livestock Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d067d90e-c9f3-413d-a9d1-ecb147bfee50", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ff09a197-fd6e-4392-89cd-21811a1a1e36", + "value": "42452" + }, + { + "description": "Livestock Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ff09a197-fd6e-4392-89cd-21811a1a1e36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d067d90e-c9f3-413d-a9d1-ecb147bfee50", + "value": "424520" + }, + { + "description": "Other Farm Product Raw Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "735ffdaf-40be-4a44-ba15-0b395913973d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d3073a25-e0a3-4d83-bd0a-4aa9db8de291", + "value": "42459" + }, + { + "description": "Other Farm Product Raw Material Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d3073a25-e0a3-4d83-bd0a-4aa9db8de291", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "735ffdaf-40be-4a44-ba15-0b395913973d", + "value": "424590" + }, + { + "description": "Chemical and Allied Products Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "212cac70-6da1-4a13-a6df-2064e8cc86d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c4fb6336-f256-4e0c-af0c-9b16bca71aac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce762a2c-2c12-4abb-9759-2670e8de2417", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c8022684-c7b7-4cb6-b0c8-6d989bc0cdd2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", + "value": "4246" + }, + { + "description": "Plastics Materials and Basic Forms and Shapes Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c4fb6336-f256-4e0c-af0c-9b16bca71aac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "212cac70-6da1-4a13-a6df-2064e8cc86d8", + "value": "42461" + }, + { + "description": "Plastics Materials and Basic Forms and Shapes Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "212cac70-6da1-4a13-a6df-2064e8cc86d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c4fb6336-f256-4e0c-af0c-9b16bca71aac", + "value": "424610" + }, + { + "description": "Other Chemical and Allied Products Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8022684-c7b7-4cb6-b0c8-6d989bc0cdd2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ce762a2c-2c12-4abb-9759-2670e8de2417", + "value": "42469" + }, + { + "description": "Other Chemical and Allied Products Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ce762a2c-2c12-4abb-9759-2670e8de2417", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c8022684-c7b7-4cb6-b0c8-6d989bc0cdd2", + "value": "424690" + }, + { + "description": "Petroleum and Petroleum Products Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e0b91189-4dfe-453c-879b-930691a69e06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4381d3b2-c9aa-4fb1-acad-3400bc726324", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "55b8cc1e-a854-415b-801d-aa4309f1c05b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1533ca3-6630-45b7-a1cd-09771153528e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", + "value": "4247" + }, + { + "description": "Petroleum Bulk Stations and Terminals ", + "related": [ + { + "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4381d3b2-c9aa-4fb1-acad-3400bc726324", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e0b91189-4dfe-453c-879b-930691a69e06", + "value": "42471" + }, + { + "description": "Petroleum Bulk Stations and Terminals ", + "related": [ + { + "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e0b91189-4dfe-453c-879b-930691a69e06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4381d3b2-c9aa-4fb1-acad-3400bc726324", + "value": "424710" + }, + { + "description": "Petroleum and Petroleum Products Merchant Wholesalers (except Bulk Stations and Terminals) ", + "related": [ + { + "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c1533ca3-6630-45b7-a1cd-09771153528e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "55b8cc1e-a854-415b-801d-aa4309f1c05b", + "value": "42472" + }, + { + "description": "Petroleum and Petroleum Products Merchant Wholesalers (except Bulk Stations and Terminals) ", + "related": [ + { + "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "55b8cc1e-a854-415b-801d-aa4309f1c05b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c1533ca3-6630-45b7-a1cd-09771153528e", + "value": "424720" + }, + { + "description": "Beer, Wine, and Distilled Alcoholic Beverage Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8d8a66f5-d670-4607-bd25-fd01ced081a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f4cff26a-af13-4a44-ba51-161178f95af0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e6ca57c8-3a8e-46e4-bcd2-2e23a719c8e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "29ad597f-7f6a-4241-9ce6-bdcacf3b9b99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", + "value": "4248" + }, + { + "description": "Beer and Ale Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f4cff26a-af13-4a44-ba51-161178f95af0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8d8a66f5-d670-4607-bd25-fd01ced081a3", + "value": "42481" + }, + { + "description": "Beer and Ale Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8d8a66f5-d670-4607-bd25-fd01ced081a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f4cff26a-af13-4a44-ba51-161178f95af0", + "value": "424810" + }, + { + "description": "Wine and Distilled Alcoholic Beverage Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "29ad597f-7f6a-4241-9ce6-bdcacf3b9b99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e6ca57c8-3a8e-46e4-bcd2-2e23a719c8e1", + "value": "42482" + }, + { + "description": "Wine and Distilled Alcoholic Beverage Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e6ca57c8-3a8e-46e4-bcd2-2e23a719c8e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "29ad597f-7f6a-4241-9ce6-bdcacf3b9b99", + "value": "424820" + }, + { + "description": "Miscellaneous Nondurable Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "12099a5c-4346-410e-80b4-965441e0406e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "af4e7e69-264a-4ae9-a9cc-d49fe947dfd3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "05fa0ef2-3225-42fa-8d7e-f5286ec6f592", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c416536e-5aa3-4269-8063-6c2cab7128ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fcb90b9d-1252-4037-84a2-29fb347a6ea4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b365ecf2-e086-4203-aac4-4cf647f38636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2ffbab58-ff37-4fd1-b0bd-61dd7813c839", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "849c21fa-f215-4417-b551-a9cdc4c1896e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "30f24e58-5845-4598-ac5a-3d72d2fef475", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eaaceee8-da8c-4c94-9d7a-473a8ad84c32", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3a603b18-495a-4997-8dc8-a2207158cac3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "69e0da85-9a66-4508-af62-8e8bb660432a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "00726563-500a-4f71-90f0-6233b559083d", + "value": "4249" + }, + { + "description": "Farm Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "af4e7e69-264a-4ae9-a9cc-d49fe947dfd3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "12099a5c-4346-410e-80b4-965441e0406e", + "value": "42491" + }, + { + "description": "Farm Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "12099a5c-4346-410e-80b4-965441e0406e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "af4e7e69-264a-4ae9-a9cc-d49fe947dfd3", + "value": "424910" + }, + { + "description": "Book, Periodical, and Newspaper Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c416536e-5aa3-4269-8063-6c2cab7128ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "05fa0ef2-3225-42fa-8d7e-f5286ec6f592", + "value": "42492" + }, + { + "description": "Book, Periodical, and Newspaper Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "05fa0ef2-3225-42fa-8d7e-f5286ec6f592", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c416536e-5aa3-4269-8063-6c2cab7128ad", + "value": "424920" + }, + { + "description": "Flower, Nursery Stock, and Florists' Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b365ecf2-e086-4203-aac4-4cf647f38636", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fcb90b9d-1252-4037-84a2-29fb347a6ea4", + "value": "42493" + }, + { + "description": "Flower, Nursery Stock, and Florists' Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fcb90b9d-1252-4037-84a2-29fb347a6ea4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b365ecf2-e086-4203-aac4-4cf647f38636", + "value": "424930" + }, + { + "description": "Tobacco Product and Electronic Cigarette Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "849c21fa-f215-4417-b551-a9cdc4c1896e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2ffbab58-ff37-4fd1-b0bd-61dd7813c839", + "value": "42494" + }, + { + "description": "Tobacco Product and Electronic Cigarette Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2ffbab58-ff37-4fd1-b0bd-61dd7813c839", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "849c21fa-f215-4417-b551-a9cdc4c1896e", + "value": "424940" + }, + { + "description": "Paint, Varnish, and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eaaceee8-da8c-4c94-9d7a-473a8ad84c32", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "30f24e58-5845-4598-ac5a-3d72d2fef475", + "value": "42495" + }, + { + "description": "Paint, Varnish, and Supplies Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "30f24e58-5845-4598-ac5a-3d72d2fef475", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eaaceee8-da8c-4c94-9d7a-473a8ad84c32", + "value": "424950" + }, + { + "description": "Other Miscellaneous Nondurable Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "69e0da85-9a66-4508-af62-8e8bb660432a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3a603b18-495a-4997-8dc8-a2207158cac3", + "value": "42499" + }, + { + "description": "Other Miscellaneous Nondurable Goods Merchant Wholesalers ", + "related": [ + { + "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a603b18-495a-4997-8dc8-a2207158cac3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "69e0da85-9a66-4508-af62-8e8bb660432a", + "value": "424990" + }, + { + "description": "Wholesale Trade Agents and Brokers ", + "related": [ + { + "dest-uuid": "263d2cb5-c44f-4fb5-a5a1-b940375f7a5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "89fb5c95-ca24-4353-863a-db5461032e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0efc2b37-40d3-4296-9fc0-3b3f40b224ad", + "value": "425" + }, + { + "description": "Wholesale Trade Agents and Brokers ", + "related": [ + { + "dest-uuid": "0efc2b37-40d3-4296-9fc0-3b3f40b224ad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0e4212ca-980f-4f5a-8069-354199eefa4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "86c6568e-ef62-4a4e-996f-021011bb9c21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "89fb5c95-ca24-4353-863a-db5461032e40", + "value": "4251" + }, + { + "description": "Wholesale Trade Agents and Brokers ", + "related": [ + { + "dest-uuid": "89fb5c95-ca24-4353-863a-db5461032e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "86c6568e-ef62-4a4e-996f-021011bb9c21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0e4212ca-980f-4f5a-8069-354199eefa4a", + "value": "42512" + }, + { + "description": "Wholesale Trade Agents and Brokers ", + "related": [ + { + "dest-uuid": "89fb5c95-ca24-4353-863a-db5461032e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0e4212ca-980f-4f5a-8069-354199eefa4a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "86c6568e-ef62-4a4e-996f-021011bb9c21", + "value": "425120" + }, + { + "description": "Retail Trade", + "related": [], + "uuid": "4e239c07-afc0-4596-817a-eac7adf9f943", + "value": "44-45" + }, + { + "description": "Motor Vehicle and Parts Dealers ", + "related": [ + { + "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "fb7acddd-75c8-4688-8ba4-fdfcd11626f8", + "value": "441" + }, + { + "description": "Automobile Dealers ", + "related": [ + { + "dest-uuid": "fb7acddd-75c8-4688-8ba4-fdfcd11626f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0b07b201-04c1-424f-85c8-ac2afe70bfaf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e7f9a645-d862-4dea-99cc-ae9541785f39", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f5542b61-86ea-41b9-a3c5-deabcc670fc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eae5e673-75bd-4b8a-a472-7d9e9e64ec5c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", + "value": "4411" + }, + { + "description": "New Car Dealers ", + "related": [ + { + "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e7f9a645-d862-4dea-99cc-ae9541785f39", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0b07b201-04c1-424f-85c8-ac2afe70bfaf", + "value": "44111" + }, + { + "description": "New Car Dealers ", + "related": [ + { + "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0b07b201-04c1-424f-85c8-ac2afe70bfaf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e7f9a645-d862-4dea-99cc-ae9541785f39", + "value": "441110" + }, + { + "description": "Used Car Dealers ", + "related": [ + { + "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eae5e673-75bd-4b8a-a472-7d9e9e64ec5c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f5542b61-86ea-41b9-a3c5-deabcc670fc8", + "value": "44112" + }, + { + "description": "Used Car Dealers ", + "related": [ + { + "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f5542b61-86ea-41b9-a3c5-deabcc670fc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eae5e673-75bd-4b8a-a472-7d9e9e64ec5c", + "value": "441120" + }, + { + "description": "Other Motor Vehicle Dealers ", + "related": [ + { + "dest-uuid": "fb7acddd-75c8-4688-8ba4-fdfcd11626f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b1e8e77-25ac-4211-9ce7-571ca7507946", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3862fd59-f78e-4ce0-b6c9-cf23dff4f233", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6e38debd-438a-418a-931f-3e085b41a139", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "406c2e51-8016-48f2-b3aa-70cc90ce6dcf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "639a7bb4-8561-44b5-af14-1ebf28d0ef01", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", + "value": "4412" + }, + { + "description": "Recreational Vehicle Dealers ", + "related": [ + { + "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3862fd59-f78e-4ce0-b6c9-cf23dff4f233", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2b1e8e77-25ac-4211-9ce7-571ca7507946", + "value": "44121" + }, + { + "description": "Recreational Vehicle Dealers ", + "related": [ + { + "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b1e8e77-25ac-4211-9ce7-571ca7507946", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3862fd59-f78e-4ce0-b6c9-cf23dff4f233", + "value": "441210" + }, + { + "description": "Motorcycle, Boat, and Other Motor Vehicle Dealers ", + "related": [ + { + "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6e38debd-438a-418a-931f-3e085b41a139", + "value": "44122" + }, + { + "description": "Boat Dealers ", + "related": [ + { + "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "406c2e51-8016-48f2-b3aa-70cc90ce6dcf", + "value": "441222" + }, + { + "description": "Motorcycle, ATV, and All Other Motor Vehicle Dealers ", + "related": [ + { + "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "639a7bb4-8561-44b5-af14-1ebf28d0ef01", + "value": "441227" + }, + { + "description": "Automotive Parts, Accessories, and Tire Retailers ", + "related": [ + { + "dest-uuid": "fb7acddd-75c8-4688-8ba4-fdfcd11626f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0a498e7b-f70a-40a1-8678-131eb18ac2af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "93667da7-9592-4bd9-bc5c-e667646bc509", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b51ec40b-91f2-4ed3-a2e7-9f8ea5ad79ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "252c245e-72ae-438e-9b9f-78b35c81a13f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", + "value": "4413" + }, + { + "description": "Automotive Parts and Accessories Retailers ", + "related": [ + { + "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "93667da7-9592-4bd9-bc5c-e667646bc509", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0a498e7b-f70a-40a1-8678-131eb18ac2af", + "value": "44133" + }, + { + "description": "Automotive Parts and Accessories Retailers ", + "related": [ + { + "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0a498e7b-f70a-40a1-8678-131eb18ac2af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "93667da7-9592-4bd9-bc5c-e667646bc509", + "value": "441330" + }, + { + "description": "Tire Dealers ", + "related": [ + { + "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "252c245e-72ae-438e-9b9f-78b35c81a13f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b51ec40b-91f2-4ed3-a2e7-9f8ea5ad79ea", + "value": "44134" + }, + { + "description": "Tire Dealers ", + "related": [ + { + "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b51ec40b-91f2-4ed3-a2e7-9f8ea5ad79ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "252c245e-72ae-438e-9b9f-78b35c81a13f", + "value": "441340" + }, + { + "description": "Building Material and Garden Equipment and Supplies Dealers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "89452db1-76f4-4824-a463-e7f6aa4d3563", + "value": "444" + }, + { + "description": "Building Material and Supplies Dealers ", + "related": [ + { + "dest-uuid": "89452db1-76f4-4824-a463-e7f6aa4d3563", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "30526fc9-99bb-454f-9d3b-e1f918f4f440", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "90645e2f-a5ce-4a9c-a7a9-8c6c118fd0c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e1f85936-c6e8-4ac4-aadb-6fcf885529e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c5d2956-844b-4378-be48-bc9c71899670", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7c61b6c0-ad4e-47bf-b93e-a8bafb4fa73d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a16ebd29-3523-4b68-91c2-5b66599db449", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0aec803d-358d-4b25-8b1b-75dfe272d311", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3745e92e-e013-407e-8c69-dc68cb1baa8c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "value": "4441" + }, + { + "description": "Home Centers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90645e2f-a5ce-4a9c-a7a9-8c6c118fd0c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "30526fc9-99bb-454f-9d3b-e1f918f4f440", + "value": "44411" + }, + { + "description": "Home Centers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "30526fc9-99bb-454f-9d3b-e1f918f4f440", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "90645e2f-a5ce-4a9c-a7a9-8c6c118fd0c7", + "value": "444110" + }, + { + "description": "Paint and Wallpaper Retailers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c5d2956-844b-4378-be48-bc9c71899670", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e1f85936-c6e8-4ac4-aadb-6fcf885529e1", + "value": "44412" + }, + { + "description": "Paint and Wallpaper Retailers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e1f85936-c6e8-4ac4-aadb-6fcf885529e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c5d2956-844b-4378-be48-bc9c71899670", + "value": "444120" + }, + { + "description": "Hardware Retailers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a16ebd29-3523-4b68-91c2-5b66599db449", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7c61b6c0-ad4e-47bf-b93e-a8bafb4fa73d", + "value": "44414" + }, + { + "description": "Hardware Retailers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7c61b6c0-ad4e-47bf-b93e-a8bafb4fa73d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a16ebd29-3523-4b68-91c2-5b66599db449", + "value": "444140" + }, + { + "description": "Other Building Material Dealers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3745e92e-e013-407e-8c69-dc68cb1baa8c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0aec803d-358d-4b25-8b1b-75dfe272d311", + "value": "44418" + }, + { + "description": "Other Building Material Dealers ", + "related": [ + { + "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0aec803d-358d-4b25-8b1b-75dfe272d311", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3745e92e-e013-407e-8c69-dc68cb1baa8c", + "value": "444180" + }, + { + "description": "Lawn and Garden Equipment and Supplies Retailers ", + "related": [ + { + "dest-uuid": "89452db1-76f4-4824-a463-e7f6aa4d3563", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8057c9fe-12df-461c-b95f-b5fd636746fb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4292e04d-0fab-42e6-9b5a-8952040a1832", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "06660897-def3-4735-9a9f-0352370cc994", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1f302a2e-01b7-46b0-bd15-04620f44e1fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", + "value": "4442" + }, + { + "description": "Outdoor Power Equipment Retailers ", + "related": [ + { + "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4292e04d-0fab-42e6-9b5a-8952040a1832", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8057c9fe-12df-461c-b95f-b5fd636746fb", + "value": "44423" + }, + { + "description": "Outdoor Power Equipment Retailers ", + "related": [ + { + "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8057c9fe-12df-461c-b95f-b5fd636746fb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4292e04d-0fab-42e6-9b5a-8952040a1832", + "value": "444230" + }, + { + "description": "Nursery, Garden Center, and Farm Supply Retailers ", + "related": [ + { + "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1f302a2e-01b7-46b0-bd15-04620f44e1fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "06660897-def3-4735-9a9f-0352370cc994", + "value": "44424" + }, + { + "description": "Nursery, Garden Center, and Farm Supply Retailers ", + "related": [ + { + "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "06660897-def3-4735-9a9f-0352370cc994", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1f302a2e-01b7-46b0-bd15-04620f44e1fc", + "value": "444240" + }, + { + "description": "Food and Beverage Retailers ", + "related": [ + { + "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ec36b6c8-1704-4f4b-b8ad-aa9a7c5244bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "01270670-e811-482c-b0e5-4b6c6ae17599", + "value": "445" + }, + { + "description": "Grocery and Convenience Retailers ", + "related": [ + { + "dest-uuid": "01270670-e811-482c-b0e5-4b6c6ae17599", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6c5d5596-76bd-48bd-9f4a-85bce3ba0529", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2c2b0c0f-c9be-4fc0-8a20-1cb128dfcc99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "53120b08-4059-4c45-b98b-a0956bada963", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3fb632fd-16a3-4f97-a2a6-be7b4b9d7e5f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4cf98cf8-d141-4273-a158-06c2bff86a87", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", + "value": "4451" + }, + { + "description": "Supermarkets and Other Grocery Retailers (except Convenience Retailers) ", + "related": [ + { + "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2c2b0c0f-c9be-4fc0-8a20-1cb128dfcc99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6c5d5596-76bd-48bd-9f4a-85bce3ba0529", + "value": "44511" + }, + { + "description": "Supermarkets and Other Grocery Retailers (except Convenience Retailers) ", + "related": [ + { + "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6c5d5596-76bd-48bd-9f4a-85bce3ba0529", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2c2b0c0f-c9be-4fc0-8a20-1cb128dfcc99", + "value": "445110" + }, + { + "description": "Convenience Retailers and Vending Machine Operators ", + "related": [ + { + "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "53120b08-4059-4c45-b98b-a0956bada963", + "value": "44513" + }, + { + "description": "Convenience Retailers ", + "related": [ + { + "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3fb632fd-16a3-4f97-a2a6-be7b4b9d7e5f", + "value": "445131" + }, + { + "description": "Vending Machine Operators ", + "related": [ + { + "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4cf98cf8-d141-4273-a158-06c2bff86a87", + "value": "445132" + }, + { + "description": "Specialty Food Retailers ", + "related": [ + { + "dest-uuid": "01270670-e811-482c-b0e5-4b6c6ae17599", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3adc5e0e-c2e3-49e6-801e-536121529999", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b7ebdb55-9ca4-45af-b573-ebe6e43b54c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bb13be9f-8b09-492f-85b5-b18866718f30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cfea0c0e-e49e-41f8-b2a9-e51c371b7585", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5efe3a41-3918-4032-8f7c-c14fe59b2990", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c5c0a31-8b03-4db6-bd82-2aba6ad8680b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "39f200fe-6ddb-47c6-b8b8-0d90fe61e51a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b11d4cfa-dc17-438b-ad1f-3b1965ef764d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d72f4225-6f81-45e0-9fe5-e9f218006ca1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce3ed722-4909-48cb-90c6-d131e4fdb5f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "value": "4452" + }, + { + "description": "Fruit and Vegetable Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b7ebdb55-9ca4-45af-b573-ebe6e43b54c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3adc5e0e-c2e3-49e6-801e-536121529999", + "value": "44523" + }, + { + "description": "Fruit and Vegetable Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3adc5e0e-c2e3-49e6-801e-536121529999", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b7ebdb55-9ca4-45af-b573-ebe6e43b54c3", + "value": "445230" + }, + { + "description": "Meat Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cfea0c0e-e49e-41f8-b2a9-e51c371b7585", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bb13be9f-8b09-492f-85b5-b18866718f30", + "value": "44524" + }, + { + "description": "Meat Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bb13be9f-8b09-492f-85b5-b18866718f30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cfea0c0e-e49e-41f8-b2a9-e51c371b7585", + "value": "445240" + }, + { + "description": "Fish and Seafood Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c5c0a31-8b03-4db6-bd82-2aba6ad8680b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5efe3a41-3918-4032-8f7c-c14fe59b2990", + "value": "44525" + }, + { + "description": "Fish and Seafood Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5efe3a41-3918-4032-8f7c-c14fe59b2990", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c5c0a31-8b03-4db6-bd82-2aba6ad8680b", + "value": "445250" + }, + { + "description": "Other Specialty Food Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "39f200fe-6ddb-47c6-b8b8-0d90fe61e51a", + "value": "44529" + }, + { + "description": "Baked Goods Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b11d4cfa-dc17-438b-ad1f-3b1965ef764d", + "value": "445291" + }, + { + "description": "Confectionery and Nut Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d72f4225-6f81-45e0-9fe5-e9f218006ca1", + "value": "445292" + }, + { + "description": "All Other Specialty Food Retailers ", + "related": [ + { + "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ce3ed722-4909-48cb-90c6-d131e4fdb5f0", + "value": "445298" + }, + { + "description": "Beer, Wine, and Liquor Retailers ", + "related": [ + { + "dest-uuid": "01270670-e811-482c-b0e5-4b6c6ae17599", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cac4edca-a94b-4460-8d49-3da59eb81eb0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "66e42203-0ab7-4c88-9f32-eba54a199fe6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ec36b6c8-1704-4f4b-b8ad-aa9a7c5244bb", + "value": "4453" + }, + { + "description": "Beer, Wine, and Liquor Retailers ", + "related": [ + { + "dest-uuid": "ec36b6c8-1704-4f4b-b8ad-aa9a7c5244bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "66e42203-0ab7-4c88-9f32-eba54a199fe6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cac4edca-a94b-4460-8d49-3da59eb81eb0", + "value": "44532" + }, + { + "description": "Beer, Wine, and Liquor Retailers ", + "related": [ + { + "dest-uuid": "ec36b6c8-1704-4f4b-b8ad-aa9a7c5244bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cac4edca-a94b-4460-8d49-3da59eb81eb0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "66e42203-0ab7-4c88-9f32-eba54a199fe6", + "value": "445320" + }, + { + "description": "Furniture, Home Furnishings, Electronics, and Appliance Retailers ", + "related": [ + { + "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1ad0a5f1-a6b7-4e83-bee9-b1cdf4d411b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1d78d5cc-683b-4810-a4b8-1db1c093fb92", + "value": "449" + }, + { + "description": "Furniture and Home Furnishings Retailers ", + "related": [ + { + "dest-uuid": "1d78d5cc-683b-4810-a4b8-1db1c093fb92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "de4e2947-3791-4fab-a519-846f22b300f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "25e2ab01-b97d-455a-bb03-15c7d1853f5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2622923b-0140-4e05-b567-5a90236381fb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "522e6f28-497c-4d56-a86f-0a3e91f223c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b4d62d7d-f728-4f4c-a291-8992f331ccf2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "01f0d69a-3c10-427e-a57c-0c9f9384edbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "value": "4491" + }, + { + "description": "Furniture Retailers ", + "related": [ + { + "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "25e2ab01-b97d-455a-bb03-15c7d1853f5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "de4e2947-3791-4fab-a519-846f22b300f8", + "value": "44911" + }, + { + "description": "Furniture Retailers ", + "related": [ + { + "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "de4e2947-3791-4fab-a519-846f22b300f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "25e2ab01-b97d-455a-bb03-15c7d1853f5e", + "value": "449110" + }, + { + "description": "Home Furnishings Retailers ", + "related": [ + { + "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2622923b-0140-4e05-b567-5a90236381fb", + "value": "44912" + }, + { + "description": "Floor Covering Retailers ", + "related": [ + { + "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "522e6f28-497c-4d56-a86f-0a3e91f223c7", + "value": "449121" + }, + { + "description": "Window Treatment Retailers ", + "related": [ + { + "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b4d62d7d-f728-4f4c-a291-8992f331ccf2", + "value": "449122" + }, + { + "description": "All Other Home Furnishings Retailers ", + "related": [ + { + "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "01f0d69a-3c10-427e-a57c-0c9f9384edbf", + "value": "449129" + }, + { + "description": "Electronics and Appliance Retailers ", + "related": [ + { + "dest-uuid": "1d78d5cc-683b-4810-a4b8-1db1c093fb92", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fee1dcf6-373e-4be9-a790-04f54c0f6525", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "462ae380-d94d-4852-851b-47f80c973541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1ad0a5f1-a6b7-4e83-bee9-b1cdf4d411b1", + "value": "4492" + }, + { + "description": "Electronics and Appliance Retailers ", + "related": [ + { + "dest-uuid": "1ad0a5f1-a6b7-4e83-bee9-b1cdf4d411b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "462ae380-d94d-4852-851b-47f80c973541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fee1dcf6-373e-4be9-a790-04f54c0f6525", + "value": "44921" + }, + { + "description": "Electronics and Appliance Retailers ", + "related": [ + { + "dest-uuid": "1ad0a5f1-a6b7-4e83-bee9-b1cdf4d411b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fee1dcf6-373e-4be9-a790-04f54c0f6525", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "462ae380-d94d-4852-851b-47f80c973541", + "value": "449210" + }, + { + "description": "General Merchandise Retailers ", + "related": [ + { + "dest-uuid": "3efe54b2-4f50-400b-b15f-7ecdd017ea8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c2d6435c-7854-4ab5-8ffa-d48f78bde470", + "value": "455" + }, + { + "description": "Department Stores ", + "related": [ + { + "dest-uuid": "c2d6435c-7854-4ab5-8ffa-d48f78bde470", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "35a13c82-9800-4b74-af20-5eb5557ec7fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0494b127-9c5c-4f8e-9da4-5e256f590091", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3efe54b2-4f50-400b-b15f-7ecdd017ea8f", + "value": "4551" + }, + { + "description": "Department Stores ", + "related": [ + { + "dest-uuid": "3efe54b2-4f50-400b-b15f-7ecdd017ea8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0494b127-9c5c-4f8e-9da4-5e256f590091", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "35a13c82-9800-4b74-af20-5eb5557ec7fa", + "value": "45511" + }, + { + "description": "Department Stores ", + "related": [ + { + "dest-uuid": "3efe54b2-4f50-400b-b15f-7ecdd017ea8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "35a13c82-9800-4b74-af20-5eb5557ec7fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0494b127-9c5c-4f8e-9da4-5e256f590091", + "value": "455110" + }, + { + "description": "Warehouse Clubs, Supercenters, and Other General Merchandise Retailers ", + "related": [ + { + "dest-uuid": "c2d6435c-7854-4ab5-8ffa-d48f78bde470", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0777f7a7-a48f-4370-9e52-3cd518bc3d7e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1d171998-2447-42e6-8b2d-38788e6289ee", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e37c7ff8-fc16-4f66-83f0-0190822843aa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", + "value": "4552" + }, + { + "description": "Warehouse Clubs, Supercenters, and Other General Merchandise Retailers ", + "related": [ + { + "dest-uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0777f7a7-a48f-4370-9e52-3cd518bc3d7e", + "value": "45521" + }, + { + "description": "Warehouse Clubs and Supercenters ", + "related": [ + { + "dest-uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1d171998-2447-42e6-8b2d-38788e6289ee", + "value": "455211" + }, + { + "description": "All Other General Merchandise Retailers ", + "related": [ + { + "dest-uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e37c7ff8-fc16-4f66-83f0-0190822843aa", + "value": "455219" + }, + { + "description": "Health and Personal Care Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bc8f36d8-e7cb-492b-b53a-89f9a7068731", + "value": "456" + }, + { + "description": "Health and Personal Care Retailers ", + "related": [ + { + "dest-uuid": "bc8f36d8-e7cb-492b-b53a-89f9a7068731", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6d5ace3c-c179-4bbb-a209-f4558ec34cca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "228e958b-b91b-4594-8e46-57625941b3dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c593d926-9231-45f4-9db3-98868df140ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f8e799a8-ab89-49ca-a232-c935962f792c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "67823fff-a5f0-4fc7-9587-6cdf2ac42869", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a860452-417e-4639-803d-bdf7b187f585", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e3e9d44e-073d-4674-8b33-d58586e8d972", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7c1f2e6d-10f9-4e67-913e-c5f40798960a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2fd347c7-6e8c-4513-8a0d-acb0d0114930", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "value": "4561" + }, + { + "description": "Pharmacies and Drug Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "228e958b-b91b-4594-8e46-57625941b3dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6d5ace3c-c179-4bbb-a209-f4558ec34cca", + "value": "45611" + }, + { + "description": "Pharmacies and Drug Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6d5ace3c-c179-4bbb-a209-f4558ec34cca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "228e958b-b91b-4594-8e46-57625941b3dc", + "value": "456110" + }, + { + "description": "Cosmetics, Beauty Supplies, and Perfume Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f8e799a8-ab89-49ca-a232-c935962f792c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c593d926-9231-45f4-9db3-98868df140ed", + "value": "45612" + }, + { + "description": "Cosmetics, Beauty Supplies, and Perfume Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c593d926-9231-45f4-9db3-98868df140ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f8e799a8-ab89-49ca-a232-c935962f792c", + "value": "456120" + }, + { + "description": "Optical Goods Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8a860452-417e-4639-803d-bdf7b187f585", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "67823fff-a5f0-4fc7-9587-6cdf2ac42869", + "value": "45613" + }, + { + "description": "Optical Goods Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "67823fff-a5f0-4fc7-9587-6cdf2ac42869", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8a860452-417e-4639-803d-bdf7b187f585", + "value": "456130" + }, + { + "description": "Other Health and Personal Care Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e3e9d44e-073d-4674-8b33-d58586e8d972", + "value": "45619" + }, + { + "description": "Food (Health) Supplement Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7c1f2e6d-10f9-4e67-913e-c5f40798960a", + "value": "456191" + }, + { + "description": "All Other Health and Personal Care Retailers ", + "related": [ + { + "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2fd347c7-6e8c-4513-8a0d-acb0d0114930", + "value": "456199" + }, + { + "description": "Gasoline Stations and Fuel Dealers ", + "related": [ + { + "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c0185539-397d-47f8-8d71-ed590b6dbf94", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9ac1af03-2efa-40fb-96fa-b64b839b9fa7", + "value": "457" + }, + { + "description": "Gasoline Stations ", + "related": [ + { + "dest-uuid": "9ac1af03-2efa-40fb-96fa-b64b839b9fa7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "698ebdf8-da19-4435-afc2-0b31f59f86b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1e0d09c2-d8de-4017-b173-fd14f34f0a47", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d667e3f3-853d-40df-977f-6bdc53d54836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "497bdb21-9fcf-479c-b434-746d0b48d1b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", + "value": "4571" + }, + { + "description": "Gasoline Stations with Convenience Stores ", + "related": [ + { + "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1e0d09c2-d8de-4017-b173-fd14f34f0a47", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "698ebdf8-da19-4435-afc2-0b31f59f86b3", + "value": "45711" + }, + { + "description": "Gasoline Stations with Convenience Stores ", + "related": [ + { + "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "698ebdf8-da19-4435-afc2-0b31f59f86b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1e0d09c2-d8de-4017-b173-fd14f34f0a47", + "value": "457110" + }, + { + "description": "Other Gasoline Stations ", + "related": [ + { + "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "497bdb21-9fcf-479c-b434-746d0b48d1b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d667e3f3-853d-40df-977f-6bdc53d54836", + "value": "45712" + }, + { + "description": "Other Gasoline Stations ", + "related": [ + { + "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d667e3f3-853d-40df-977f-6bdc53d54836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "497bdb21-9fcf-479c-b434-746d0b48d1b1", + "value": "457120" + }, + { + "description": "Fuel Dealers", + "related": [ + { + "dest-uuid": "9ac1af03-2efa-40fb-96fa-b64b839b9fa7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a23d9f0f-254e-437f-83b3-65e5a6bb78c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "375ca34c-034f-4b3e-a30a-f17cc8f3018f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c0185539-397d-47f8-8d71-ed590b6dbf94", + "value": "4572" + }, + { + "description": "Fuel Dealers", + "related": [ + { + "dest-uuid": "c0185539-397d-47f8-8d71-ed590b6dbf94", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "375ca34c-034f-4b3e-a30a-f17cc8f3018f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a23d9f0f-254e-437f-83b3-65e5a6bb78c4", + "value": "45721" + }, + { + "description": "Fuel Dealers ", + "related": [ + { + "dest-uuid": "c0185539-397d-47f8-8d71-ed590b6dbf94", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a23d9f0f-254e-437f-83b3-65e5a6bb78c4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "375ca34c-034f-4b3e-a30a-f17cc8f3018f", + "value": "457210" + }, + { + "description": "Clothing, Clothing Accessories, Shoe, and Jewelry Retailers ", + "related": [ + { + "dest-uuid": "aba17827-fac1-48c4-9920-08e5c877ed17", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "12327773-ef57-43c0-a13c-a56b02bc3df4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9eb95e6c-d2a0-42a7-bf0b-e124351536a8", + "value": "458" + }, + { + "description": "Clothing and Clothing Accessories Retailers ", + "related": [ + { + "dest-uuid": "9eb95e6c-d2a0-42a7-bf0b-e124351536a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "40f6cc8a-4c5e-4f92-88c7-eaf36c3c4ccd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "924c50fb-3bd8-4875-8568-44a1a270af97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "aba17827-fac1-48c4-9920-08e5c877ed17", + "value": "4581" + }, + { + "description": "Clothing and Clothing Accessories Retailers ", + "related": [ + { + "dest-uuid": "aba17827-fac1-48c4-9920-08e5c877ed17", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "924c50fb-3bd8-4875-8568-44a1a270af97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "40f6cc8a-4c5e-4f92-88c7-eaf36c3c4ccd", + "value": "45811" + }, + { + "description": "Clothing and Clothing Accessories Retailers ", + "related": [ + { + "dest-uuid": "aba17827-fac1-48c4-9920-08e5c877ed17", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "40f6cc8a-4c5e-4f92-88c7-eaf36c3c4ccd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "924c50fb-3bd8-4875-8568-44a1a270af97", + "value": "458110" + }, + { + "description": "Shoe Retailers ", + "related": [ + { + "dest-uuid": "9eb95e6c-d2a0-42a7-bf0b-e124351536a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c1d7050c-be62-4594-8334-875bff10c7d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "168484a3-fd58-4846-a995-7827f2144def", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "12327773-ef57-43c0-a13c-a56b02bc3df4", + "value": "4582" + }, + { + "description": "Shoe Retailers ", + "related": [ + { + "dest-uuid": "12327773-ef57-43c0-a13c-a56b02bc3df4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "168484a3-fd58-4846-a995-7827f2144def", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c1d7050c-be62-4594-8334-875bff10c7d8", + "value": "45821" + }, + { + "description": "Shoe Retailers ", + "related": [ + { + "dest-uuid": "12327773-ef57-43c0-a13c-a56b02bc3df4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c1d7050c-be62-4594-8334-875bff10c7d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "168484a3-fd58-4846-a995-7827f2144def", + "value": "458210" + }, + { + "description": "Jewelry, Luggage, and Leather Goods Retailers ", + "related": [ + { + "dest-uuid": "9eb95e6c-d2a0-42a7-bf0b-e124351536a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "09449dda-0522-4112-ba98-c2e0efcd9a06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "db56fd27-d18a-4e9f-aaa8-12027f26f98e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1db583d5-3958-4fb0-8a9c-f77cca2ec9c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "031b8d2b-64e7-4a49-b8e5-911bd084a88a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", + "value": "4583" + }, + { + "description": "Jewelry Retailers ", + "related": [ + { + "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "db56fd27-d18a-4e9f-aaa8-12027f26f98e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "09449dda-0522-4112-ba98-c2e0efcd9a06", + "value": "45831" + }, + { + "description": "Jewelry Retailers ", + "related": [ + { + "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "09449dda-0522-4112-ba98-c2e0efcd9a06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "db56fd27-d18a-4e9f-aaa8-12027f26f98e", + "value": "458310" + }, + { + "description": "Luggage and Leather Goods Retailers ", + "related": [ + { + "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "031b8d2b-64e7-4a49-b8e5-911bd084a88a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1db583d5-3958-4fb0-8a9c-f77cca2ec9c5", + "value": "45832" + }, + { + "description": "Luggage and Leather Goods Retailers ", + "related": [ + { + "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1db583d5-3958-4fb0-8a9c-f77cca2ec9c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "031b8d2b-64e7-4a49-b8e5-911bd084a88a", + "value": "458320" + }, + { + "description": "Sporting Goods, Hobby, Musical Instrument, Book, and Miscellaneous Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "62054d35-82cf-4219-92f3-73ab70c6f72a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b725df0b-b77f-409c-89ca-a37ccb89de6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8bb7111f-582f-4992-9a5e-4bd20db92d6a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", + "value": "459" + }, + { + "description": "Sporting Goods, Hobby, and Musical Instrument Retailers ", + "related": [ + { + "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90548e73-3796-4019-87fc-8427935e4b85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c7e003e2-4409-411a-a8bd-119d23ee5112", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b0490596-1155-4a1f-9b37-2cd7a4d8b216", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0f04e2ff-219b-47f6-9ba6-b9867b7f5b98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "109adeb0-6b07-4344-af87-2df21c56879c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "20b201ad-89e1-4458-a511-fa308cab304d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bc5cea8e-6e96-40bf-bc9f-65aedb35afd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0690757e-c0fd-4bf9-a336-258b0c3ede57", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "value": "4591" + }, + { + "description": "Sporting Goods Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c7e003e2-4409-411a-a8bd-119d23ee5112", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "90548e73-3796-4019-87fc-8427935e4b85", + "value": "45911" + }, + { + "description": "Sporting Goods Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90548e73-3796-4019-87fc-8427935e4b85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c7e003e2-4409-411a-a8bd-119d23ee5112", + "value": "459110" + }, + { + "description": "Hobby, Toy, and Game Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0f04e2ff-219b-47f6-9ba6-b9867b7f5b98", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b0490596-1155-4a1f-9b37-2cd7a4d8b216", + "value": "45912" + }, + { + "description": "Hobby, Toy, and Game Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b0490596-1155-4a1f-9b37-2cd7a4d8b216", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0f04e2ff-219b-47f6-9ba6-b9867b7f5b98", + "value": "459120" + }, + { + "description": "Sewing, Needlework, and Piece Goods Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "20b201ad-89e1-4458-a511-fa308cab304d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "109adeb0-6b07-4344-af87-2df21c56879c", + "value": "45913" + }, + { + "description": "Sewing, Needlework, and Piece Goods Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "109adeb0-6b07-4344-af87-2df21c56879c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "20b201ad-89e1-4458-a511-fa308cab304d", + "value": "459130" + }, + { + "description": "Musical Instrument and Supplies Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0690757e-c0fd-4bf9-a336-258b0c3ede57", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bc5cea8e-6e96-40bf-bc9f-65aedb35afd1", + "value": "45914" + }, + { + "description": "Musical Instrument and Supplies Retailers ", + "related": [ + { + "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bc5cea8e-6e96-40bf-bc9f-65aedb35afd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0690757e-c0fd-4bf9-a336-258b0c3ede57", + "value": "459140" + }, + { + "description": "Book Retailers and News Dealers ", + "related": [ + { + "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5169f901-d2d8-451d-ab5d-ebf09453c9f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d60fb0fb-d188-41ea-9189-54e0fca9b86f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "62054d35-82cf-4219-92f3-73ab70c6f72a", + "value": "4592" + }, + { + "description": "Book Retailers and News Dealers ", + "related": [ + { + "dest-uuid": "62054d35-82cf-4219-92f3-73ab70c6f72a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d60fb0fb-d188-41ea-9189-54e0fca9b86f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5169f901-d2d8-451d-ab5d-ebf09453c9f3", + "value": "45921" + }, + { + "description": "Book Retailers and News Dealers ", + "related": [ + { + "dest-uuid": "62054d35-82cf-4219-92f3-73ab70c6f72a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5169f901-d2d8-451d-ab5d-ebf09453c9f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d60fb0fb-d188-41ea-9189-54e0fca9b86f", + "value": "459210" + }, + { + "description": "Florists ", + "related": [ + { + "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e0448711-bfe0-4213-a96f-4f6365f31ca1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a6cd4fbe-9a36-4ead-b5f7-8648d6cc1bc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b725df0b-b77f-409c-89ca-a37ccb89de6d", + "value": "4593" + }, + { + "description": "Florists ", + "related": [ + { + "dest-uuid": "b725df0b-b77f-409c-89ca-a37ccb89de6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a6cd4fbe-9a36-4ead-b5f7-8648d6cc1bc4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e0448711-bfe0-4213-a96f-4f6365f31ca1", + "value": "45931" + }, + { + "description": "Florists ", + "related": [ + { + "dest-uuid": "b725df0b-b77f-409c-89ca-a37ccb89de6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e0448711-bfe0-4213-a96f-4f6365f31ca1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a6cd4fbe-9a36-4ead-b5f7-8648d6cc1bc4", + "value": "459310" + }, + { + "description": "Office Supplies, Stationery, and Gift Retailers ", + "related": [ + { + "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f06f49e2-581e-4968-b2ad-a4d3fa425874", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c673448e-a3e1-4b9f-b941-b2d08f914d68", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b69196a1-ba7a-41aa-b719-c919de6e2933", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a7f00b79-12ba-4608-b793-1e9370a4dedd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bcf40586-411a-4bef-9d28-77c796adac84", + "value": "4594" + }, + { + "description": "Office Supplies and Stationery Retailers ", + "related": [ + { + "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c673448e-a3e1-4b9f-b941-b2d08f914d68", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f06f49e2-581e-4968-b2ad-a4d3fa425874", + "value": "45941" + }, + { + "description": "Office Supplies and Stationery Retailers ", + "related": [ + { + "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f06f49e2-581e-4968-b2ad-a4d3fa425874", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c673448e-a3e1-4b9f-b941-b2d08f914d68", + "value": "459410" + }, + { + "description": "Gift, Novelty, and Souvenir Retailers ", + "related": [ + { + "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a7f00b79-12ba-4608-b793-1e9370a4dedd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b69196a1-ba7a-41aa-b719-c919de6e2933", + "value": "45942" + }, + { + "description": "Gift, Novelty, and Souvenir Retailers ", + "related": [ + { + "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b69196a1-ba7a-41aa-b719-c919de6e2933", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a7f00b79-12ba-4608-b793-1e9370a4dedd", + "value": "459420" + }, + { + "description": "Used Merchandise Retailers ", + "related": [ + { + "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3220683a-f7a5-4fbc-b2a8-88e1368dbabb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1f2a511c-55bc-4e70-8392-3aa56b7a413a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8bb7111f-582f-4992-9a5e-4bd20db92d6a", + "value": "4595" + }, + { + "description": "Used Merchandise Retailers ", + "related": [ + { + "dest-uuid": "8bb7111f-582f-4992-9a5e-4bd20db92d6a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1f2a511c-55bc-4e70-8392-3aa56b7a413a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3220683a-f7a5-4fbc-b2a8-88e1368dbabb", + "value": "45951" + }, + { + "description": "Used Merchandise Retailers ", + "related": [ + { + "dest-uuid": "8bb7111f-582f-4992-9a5e-4bd20db92d6a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3220683a-f7a5-4fbc-b2a8-88e1368dbabb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1f2a511c-55bc-4e70-8392-3aa56b7a413a", + "value": "459510" + }, + { + "description": "Other Miscellaneous Retailers ", + "related": [ + { + "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1411329f-3b1f-4807-b2bb-c42fd6768631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2a0d2dac-b7cf-4025-ae77-c84a057554a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "464162a1-55ca-404a-aa5d-a864edc6c566", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0e1f0a8d-afac-45ba-8ed6-8cd074478940", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "98489202-66e5-4372-bbbe-5dc53d291911", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5e13caf1-d197-4f8e-9831-daedcc0a7b83", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5fb8ab1a-91ba-4382-b861-4c21bd17d7ae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6779de97-29f1-453e-a0df-e0eafc9c3f90", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b169ae33-a59d-46c0-b696-dc74466130ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "value": "4599" + }, + { + "description": "Pet and Pet Supplies Retailers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2a0d2dac-b7cf-4025-ae77-c84a057554a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1411329f-3b1f-4807-b2bb-c42fd6768631", + "value": "45991" + }, + { + "description": "Pet and Pet Supplies Retailers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1411329f-3b1f-4807-b2bb-c42fd6768631", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2a0d2dac-b7cf-4025-ae77-c84a057554a1", + "value": "459910" + }, + { + "description": "Art Dealers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0e1f0a8d-afac-45ba-8ed6-8cd074478940", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "464162a1-55ca-404a-aa5d-a864edc6c566", + "value": "45992" + }, + { + "description": "Art Dealers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "464162a1-55ca-404a-aa5d-a864edc6c566", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0e1f0a8d-afac-45ba-8ed6-8cd074478940", + "value": "459920" + }, + { + "description": "Manufactured (Mobile) Home Dealers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5e13caf1-d197-4f8e-9831-daedcc0a7b83", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "98489202-66e5-4372-bbbe-5dc53d291911", + "value": "45993" + }, + { + "description": "Manufactured (Mobile) Home Dealers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "98489202-66e5-4372-bbbe-5dc53d291911", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5e13caf1-d197-4f8e-9831-daedcc0a7b83", + "value": "459930" + }, + { + "description": "All Other Miscellaneous Retailers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5fb8ab1a-91ba-4382-b861-4c21bd17d7ae", + "value": "45999" + }, + { + "description": "Tobacco, Electronic Cigarette, and Other Smoking Supplies Retailers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6779de97-29f1-453e-a0df-e0eafc9c3f90", + "value": "459991" + }, + { + "description": "All Other Miscellaneous Retailers ", + "related": [ + { + "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b169ae33-a59d-46c0-b696-dc74466130ed", + "value": "459999" + }, + { + "description": "Transportation and Warehousing", + "related": [], + "uuid": "dc631271-88f8-42a7-abe2-823d023ea6ba", + "value": "48-49" + }, + { + "description": "Air Transportation", + "related": [ + { + "dest-uuid": "53613cf1-7055-4d5c-b17d-c072ce427675", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "10129f6b-6ed4-4860-b05a-2e0364b83126", + "value": "481" + }, + { + "description": "Scheduled Air Transportation", + "related": [ + { + "dest-uuid": "10129f6b-6ed4-4860-b05a-2e0364b83126", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "305d4610-a74c-46fb-8c0b-a3516d4e03d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f8c17f97-007d-4199-865b-c9a1f333e18f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4609d179-e821-4d99-b0d3-88c0b9ac4120", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "53613cf1-7055-4d5c-b17d-c072ce427675", + "value": "4811" + }, + { + "description": "Scheduled Air Transportation", + "related": [ + { + "dest-uuid": "53613cf1-7055-4d5c-b17d-c072ce427675", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "305d4610-a74c-46fb-8c0b-a3516d4e03d1", + "value": "48111" + }, + { + "description": "Scheduled Passenger Air Transportation ", + "related": [ + { + "dest-uuid": "53613cf1-7055-4d5c-b17d-c072ce427675", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f8c17f97-007d-4199-865b-c9a1f333e18f", + "value": "481111" + }, + { + "description": "Scheduled Freight Air Transportation ", + "related": [ + { + "dest-uuid": "53613cf1-7055-4d5c-b17d-c072ce427675", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4609d179-e821-4d99-b0d3-88c0b9ac4120", + "value": "481112" + }, + { + "description": "Nonscheduled Air Transportation", + "related": [ + { + "dest-uuid": "10129f6b-6ed4-4860-b05a-2e0364b83126", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fa4d40f8-db4e-4229-9fa6-2926b91a79bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "303e9adc-cddb-48a6-8c8b-96e90d2ae3dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9c321356-e2e4-45a9-b106-bc6d859303bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c3076102-4438-4b2b-ab25-1ce06774ccaf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", + "value": "4812" + }, + { + "description": "Nonscheduled Air Transportation", + "related": [ + { + "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fa4d40f8-db4e-4229-9fa6-2926b91a79bf", + "value": "48121" + }, + { + "description": "Nonscheduled Chartered Passenger Air Transportation ", + "related": [ + { + "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "303e9adc-cddb-48a6-8c8b-96e90d2ae3dc", + "value": "481211" + }, + { + "description": "Nonscheduled Chartered Freight Air Transportation ", + "related": [ + { + "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9c321356-e2e4-45a9-b106-bc6d859303bf", + "value": "481212" + }, + { + "description": "Other Nonscheduled Air Transportation ", + "related": [ + { + "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c3076102-4438-4b2b-ab25-1ce06774ccaf", + "value": "481219" + }, + { + "description": "Rail Transportation", + "related": [ + { + "dest-uuid": "35378118-c241-4974-a32c-d9695a1b5d5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b9c64d09-cd39-4eaa-8444-90b291148d8d", + "value": "482" + }, + { + "description": "Rail Transportation", + "related": [ + { + "dest-uuid": "b9c64d09-cd39-4eaa-8444-90b291148d8d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2053f9bb-e1a2-4747-89d4-40f7f65bfb41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b0ce89c8-1358-4dc6-b4fb-1032daef76a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "baedfacc-dbcb-4d0f-812b-421cb7de7834", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "35378118-c241-4974-a32c-d9695a1b5d5e", + "value": "4821" + }, + { + "description": "Rail Transportation", + "related": [ + { + "dest-uuid": "35378118-c241-4974-a32c-d9695a1b5d5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2053f9bb-e1a2-4747-89d4-40f7f65bfb41", + "value": "48211" + }, + { + "description": "Line-Haul Railroads ", + "related": [ + { + "dest-uuid": "35378118-c241-4974-a32c-d9695a1b5d5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b0ce89c8-1358-4dc6-b4fb-1032daef76a7", + "value": "482111" + }, + { + "description": "Short Line Railroads ", + "related": [ + { + "dest-uuid": "35378118-c241-4974-a32c-d9695a1b5d5e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "baedfacc-dbcb-4d0f-812b-421cb7de7834", + "value": "482112" + }, + { + "description": "Water Transportation", + "related": [ + { + "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9297dfbb-9653-48c7-b982-9260ff0f9fea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3b0a29f9-d955-46e8-ae6c-001df44120ec", + "value": "483" + }, + { + "description": "Deep Sea, Coastal, and Great Lakes Water Transportation", + "related": [ + { + "dest-uuid": "3b0a29f9-d955-46e8-ae6c-001df44120ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ad42b1e7-278b-47fd-9f29-8d91fea182ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4f73d50a-4b0e-4414-9aae-0716572c674c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ac63e5c5-b813-4c02-b12c-9955d6e815e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c50c42a-66ec-415b-af47-5bafb1345feb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "53bf465e-8ed2-46e1-97a7-605f0f1fa74b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", + "value": "4831" + }, + { + "description": "Deep Sea, Coastal, and Great Lakes Water Transportation", + "related": [ + { + "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ad42b1e7-278b-47fd-9f29-8d91fea182ec", + "value": "48311" + }, + { + "description": "Deep Sea Freight Transportation ", + "related": [ + { + "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4f73d50a-4b0e-4414-9aae-0716572c674c", + "value": "483111" + }, + { + "description": "Deep Sea Passenger Transportation ", + "related": [ + { + "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ac63e5c5-b813-4c02-b12c-9955d6e815e1", + "value": "483112" + }, + { + "description": "Coastal and Great Lakes Freight Transportation ", + "related": [ + { + "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8c50c42a-66ec-415b-af47-5bafb1345feb", + "value": "483113" + }, + { + "description": "Coastal and Great Lakes Passenger Transportation ", + "related": [ + { + "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "53bf465e-8ed2-46e1-97a7-605f0f1fa74b", + "value": "483114" + }, + { + "description": "Inland Water Transportation", + "related": [ + { + "dest-uuid": "3b0a29f9-d955-46e8-ae6c-001df44120ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7356ed6a-a77a-4ef0-a8ca-6d40408b8415", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ee781586-cd2a-49d5-aeb3-d4137de96ee2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "451d9ad0-8476-4361-b6f6-3c3e4858401f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9297dfbb-9653-48c7-b982-9260ff0f9fea", + "value": "4832" + }, + { + "description": "Inland Water Transportation", + "related": [ + { + "dest-uuid": "9297dfbb-9653-48c7-b982-9260ff0f9fea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7356ed6a-a77a-4ef0-a8ca-6d40408b8415", + "value": "48321" + }, + { + "description": "Inland Water Freight Transportation ", + "related": [ + { + "dest-uuid": "9297dfbb-9653-48c7-b982-9260ff0f9fea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ee781586-cd2a-49d5-aeb3-d4137de96ee2", + "value": "483211" + }, + { + "description": "Inland Water Passenger Transportation ", + "related": [ + { + "dest-uuid": "9297dfbb-9653-48c7-b982-9260ff0f9fea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "451d9ad0-8476-4361-b6f6-3c3e4858401f", + "value": "483212" + }, + { + "description": "Truck Transportation", + "related": [ + { + "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bc3028e3-4aca-41be-aeaa-018d3f7b10a0", + "value": "484" + }, + { + "description": "General Freight Trucking", + "related": [ + { + "dest-uuid": "bc3028e3-4aca-41be-aeaa-018d3f7b10a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b8277846-df62-41e0-9fb5-ba79b8ce4f4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3ec913ac-11f0-4ac1-b216-d13871c500ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "70026cfa-995b-4591-82be-85fc23a11532", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8e1fbced-7554-4557-acf2-89850312849b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f67f223c-96f2-46f8-af4f-20243e2ad0c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", + "value": "4841" + }, + { + "description": "General Freight Trucking, Local", + "related": [ + { + "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3ec913ac-11f0-4ac1-b216-d13871c500ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b8277846-df62-41e0-9fb5-ba79b8ce4f4f", + "value": "48411" + }, + { + "description": "General Freight Trucking, Local ", + "related": [ + { + "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b8277846-df62-41e0-9fb5-ba79b8ce4f4f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3ec913ac-11f0-4ac1-b216-d13871c500ce", + "value": "484110" + }, + { + "description": "General Freight Trucking, Long-Distance", + "related": [ + { + "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "70026cfa-995b-4591-82be-85fc23a11532", + "value": "48412" + }, + { + "description": "General Freight Trucking, Long-Distance, Truckload ", + "related": [ + { + "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8e1fbced-7554-4557-acf2-89850312849b", + "value": "484121" + }, + { + "description": "General Freight Trucking, Long-Distance, Less Than Truckload ", + "related": [ + { + "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f67f223c-96f2-46f8-af4f-20243e2ad0c6", + "value": "484122" + }, + { + "description": "Specialized Freight Trucking", + "related": [ + { + "dest-uuid": "bc3028e3-4aca-41be-aeaa-018d3f7b10a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "701e98bb-a97e-4dc9-a505-0693a086410a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aa0efaa9-9996-46b1-9ae6-f417f6549014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f8eeda12-cf4a-4381-b89f-cc1fb3addd66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1eeec7e3-b46e-4eae-a451-2b3e9e5f1004", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a25c580b-9206-452b-94f6-16af13e28dd8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e70865a5-ecf3-493c-9d67-b12e12838a7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "value": "4842" + }, + { + "description": "Used Household and Office Goods Moving", + "related": [ + { + "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aa0efaa9-9996-46b1-9ae6-f417f6549014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "701e98bb-a97e-4dc9-a505-0693a086410a", + "value": "48421" + }, + { + "description": "Used Household and Office Goods Moving", + "related": [ + { + "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "701e98bb-a97e-4dc9-a505-0693a086410a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "aa0efaa9-9996-46b1-9ae6-f417f6549014", + "value": "484210" + }, + { + "description": "Specialized Freight (except Used Goods) Trucking, Local", + "related": [ + { + "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1eeec7e3-b46e-4eae-a451-2b3e9e5f1004", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f8eeda12-cf4a-4381-b89f-cc1fb3addd66", + "value": "48422" + }, + { + "description": "Specialized Freight (except Used Goods) Trucking, Local ", + "related": [ + { + "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f8eeda12-cf4a-4381-b89f-cc1fb3addd66", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1eeec7e3-b46e-4eae-a451-2b3e9e5f1004", + "value": "484220" + }, + { + "description": "Specialized Freight (except Used Goods) Trucking, Long-Distance", + "related": [ + { + "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e70865a5-ecf3-493c-9d67-b12e12838a7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a25c580b-9206-452b-94f6-16af13e28dd8", + "value": "48423" + }, + { + "description": "Specialized Freight (except Used Goods) Trucking, Long-Distance ", + "related": [ + { + "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a25c580b-9206-452b-94f6-16af13e28dd8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e70865a5-ecf3-493c-9d67-b12e12838a7b", + "value": "484230" + }, + { + "description": "Transit and Ground Passenger Transportation", + "related": [ + { + "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "45302b19-62b0-4ec2-95b9-3563ef827602", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8b4e7868-d084-4b73-a885-da3bb1886103", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dc11d190-2fd0-45ba-a8a9-1696b4e5285d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "02f6f237-c51f-43ec-9eb4-3d456d8bdde0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "748d12c1-02d2-4941-89fc-5146e0045e93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ea62c60c-9d68-406a-b80c-51b125796f10", + "value": "485" + }, + { + "description": "Urban Transit Systems", + "related": [ + { + "dest-uuid": "ea62c60c-9d68-406a-b80c-51b125796f10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d4b8357d-750a-4643-aaa8-fe86fc110081", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6cf4b0b3-e1cf-43c5-b591-6db5c363c40e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d1173de9-dc38-4dcb-b184-03e9d0a90117", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4c5ee01e-73f2-4700-8f25-919f89ce9e1e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9285cf8b-74fe-4b3e-bf04-7c2f3801e9fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", + "value": "4851" + }, + { + "description": "Urban Transit Systems", + "related": [ + { + "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d4b8357d-750a-4643-aaa8-fe86fc110081", + "value": "48511" + }, + { + "description": "Mixed Mode Transit Systems ", + "related": [ + { + "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6cf4b0b3-e1cf-43c5-b591-6db5c363c40e", + "value": "485111" + }, + { + "description": "Commuter Rail Systems ", + "related": [ + { + "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d1173de9-dc38-4dcb-b184-03e9d0a90117", + "value": "485112" + }, + { + "description": "Bus and Other Motor Vehicle Transit Systems ", + "related": [ + { + "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4c5ee01e-73f2-4700-8f25-919f89ce9e1e", + "value": "485113" + }, + { + "description": "Other Urban Transit Systems ", + "related": [ + { + "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9285cf8b-74fe-4b3e-bf04-7c2f3801e9fc", + "value": "485119" + }, + { + "description": "Interurban and Rural Bus Transportation", + "related": [ + { + "dest-uuid": "ea62c60c-9d68-406a-b80c-51b125796f10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "424f492f-5744-4afc-a651-95a1a78ee375", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9aa0e3af-b66f-4287-9219-5240a5dc2920", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "45302b19-62b0-4ec2-95b9-3563ef827602", + "value": "4852" + }, + { + "description": "Interurban and Rural Bus Transportation", + "related": [ + { + "dest-uuid": "45302b19-62b0-4ec2-95b9-3563ef827602", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9aa0e3af-b66f-4287-9219-5240a5dc2920", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "424f492f-5744-4afc-a651-95a1a78ee375", + "value": "48521" + }, + { + "description": "Interurban and Rural Bus Transportation", + "related": [ + { + "dest-uuid": "45302b19-62b0-4ec2-95b9-3563ef827602", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "424f492f-5744-4afc-a651-95a1a78ee375", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9aa0e3af-b66f-4287-9219-5240a5dc2920", + "value": "485210" + }, + { + "description": "Taxi and Limousine Service", + "related": [ + { + "dest-uuid": "ea62c60c-9d68-406a-b80c-51b125796f10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b0fbebb-895c-4674-bc9c-6d12143cf07a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3a264258-f775-4375-8a1b-4f8de69a3b9a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0f09f066-cfd6-402d-9fc0-de21f13252ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b9fd2786-1418-496e-88df-bfed3c04c5ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8b4e7868-d084-4b73-a885-da3bb1886103", + "value": "4853" + }, + { + "description": "Taxi and Ridesharing Services", + "related": [ + { + "dest-uuid": "8b4e7868-d084-4b73-a885-da3bb1886103", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a264258-f775-4375-8a1b-4f8de69a3b9a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2b0fbebb-895c-4674-bc9c-6d12143cf07a", + "value": "48531" + }, + { + "description": "Taxi and Ridesharing Services ", + "related": [ + { + "dest-uuid": "8b4e7868-d084-4b73-a885-da3bb1886103", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b0fbebb-895c-4674-bc9c-6d12143cf07a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3a264258-f775-4375-8a1b-4f8de69a3b9a", + "value": "485310" + }, + { + "description": "Limousine Service", + "related": [ + { + "dest-uuid": "8b4e7868-d084-4b73-a885-da3bb1886103", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b9fd2786-1418-496e-88df-bfed3c04c5ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0f09f066-cfd6-402d-9fc0-de21f13252ea", + "value": "48532" + }, + { + "description": "Limousine Service", + "related": [ + { + "dest-uuid": "8b4e7868-d084-4b73-a885-da3bb1886103", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0f09f066-cfd6-402d-9fc0-de21f13252ea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b9fd2786-1418-496e-88df-bfed3c04c5ec", + "value": "485320" + }, + { + "description": "School and Employee Bus Transportation", + "related": [ + { + "dest-uuid": "ea62c60c-9d68-406a-b80c-51b125796f10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "18c40508-d53d-41b5-88e2-9b0e9b44bdeb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "420600bf-98fe-4f0a-a028-aa58e35801e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "dc11d190-2fd0-45ba-a8a9-1696b4e5285d", + "value": "4854" + }, + { + "description": "School and Employee Bus Transportation", + "related": [ + { + "dest-uuid": "dc11d190-2fd0-45ba-a8a9-1696b4e5285d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "420600bf-98fe-4f0a-a028-aa58e35801e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "18c40508-d53d-41b5-88e2-9b0e9b44bdeb", + "value": "48541" + }, + { + "description": "School and Employee Bus Transportation", + "related": [ + { + "dest-uuid": "dc11d190-2fd0-45ba-a8a9-1696b4e5285d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "18c40508-d53d-41b5-88e2-9b0e9b44bdeb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "420600bf-98fe-4f0a-a028-aa58e35801e7", + "value": "485410" + }, + { + "description": "Charter Bus Industry", + "related": [ + { + "dest-uuid": "ea62c60c-9d68-406a-b80c-51b125796f10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9bf5d8f5-40fd-4992-85eb-4e1de1f947f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a0ccf94c-7aeb-4941-a226-69095da7ca60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "02f6f237-c51f-43ec-9eb4-3d456d8bdde0", + "value": "4855" + }, + { + "description": "Charter Bus Industry", + "related": [ + { + "dest-uuid": "02f6f237-c51f-43ec-9eb4-3d456d8bdde0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a0ccf94c-7aeb-4941-a226-69095da7ca60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9bf5d8f5-40fd-4992-85eb-4e1de1f947f5", + "value": "48551" + }, + { + "description": "Charter Bus Industry", + "related": [ + { + "dest-uuid": "02f6f237-c51f-43ec-9eb4-3d456d8bdde0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9bf5d8f5-40fd-4992-85eb-4e1de1f947f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a0ccf94c-7aeb-4941-a226-69095da7ca60", + "value": "485510" + }, + { + "description": "Other Transit and Ground Passenger Transportation", + "related": [ + { + "dest-uuid": "ea62c60c-9d68-406a-b80c-51b125796f10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8969a43b-08c6-4b1c-b0bc-05fbc84cd479", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d7ae3c3-e563-46e4-af1d-061f452a8451", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1c66a841-36c3-4111-8757-fa9e425b5672", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "748d12c1-02d2-4941-89fc-5146e0045e93", + "value": "4859" + }, + { + "description": "Other Transit and Ground Passenger Transportation", + "related": [ + { + "dest-uuid": "748d12c1-02d2-4941-89fc-5146e0045e93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8969a43b-08c6-4b1c-b0bc-05fbc84cd479", + "value": "48599" + }, + { + "description": "Special Needs Transportation ", + "related": [ + { + "dest-uuid": "748d12c1-02d2-4941-89fc-5146e0045e93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7d7ae3c3-e563-46e4-af1d-061f452a8451", + "value": "485991" + }, + { + "description": "All Other Transit and Ground Passenger Transportation ", + "related": [ + { + "dest-uuid": "748d12c1-02d2-4941-89fc-5146e0045e93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1c66a841-36c3-4111-8757-fa9e425b5672", + "value": "485999" + }, + { + "description": "Pipeline Transportation", + "related": [ + { + "dest-uuid": "216e2356-8883-4d7f-8c1f-0d810631b539", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "47efa04c-e79c-465c-ae36-ed5943b7df6c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "180044a7-668f-42aa-9298-ed87d0b200da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "417053d7-3c48-436a-b1da-8cb216c48c7f", + "value": "486" + }, + { + "description": "Pipeline Transportation of Crude Oil", + "related": [ + { + "dest-uuid": "417053d7-3c48-436a-b1da-8cb216c48c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "049628ff-c176-4df0-b73a-b7226b7b002d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ccc8b66b-497a-420c-879d-8948e0c5b46a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "216e2356-8883-4d7f-8c1f-0d810631b539", + "value": "4861" + }, + { + "description": "Pipeline Transportation of Crude Oil", + "related": [ + { + "dest-uuid": "216e2356-8883-4d7f-8c1f-0d810631b539", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ccc8b66b-497a-420c-879d-8948e0c5b46a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "049628ff-c176-4df0-b73a-b7226b7b002d", + "value": "48611" + }, + { + "description": "Pipeline Transportation of Crude Oil", + "related": [ + { + "dest-uuid": "216e2356-8883-4d7f-8c1f-0d810631b539", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "049628ff-c176-4df0-b73a-b7226b7b002d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ccc8b66b-497a-420c-879d-8948e0c5b46a", + "value": "486110" + }, + { + "description": "Pipeline Transportation of Natural Gas", + "related": [ + { + "dest-uuid": "417053d7-3c48-436a-b1da-8cb216c48c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cf179605-6bd4-4edc-9408-061fcc667cee", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3bd56221-dd71-4635-83d7-716678b09bd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "47efa04c-e79c-465c-ae36-ed5943b7df6c", + "value": "4862" + }, + { + "description": "Pipeline Transportation of Natural Gas", + "related": [ + { + "dest-uuid": "47efa04c-e79c-465c-ae36-ed5943b7df6c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3bd56221-dd71-4635-83d7-716678b09bd1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cf179605-6bd4-4edc-9408-061fcc667cee", + "value": "48621" + }, + { + "description": "Pipeline Transportation of Natural Gas", + "related": [ + { + "dest-uuid": "47efa04c-e79c-465c-ae36-ed5943b7df6c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cf179605-6bd4-4edc-9408-061fcc667cee", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3bd56221-dd71-4635-83d7-716678b09bd1", + "value": "486210" + }, + { + "description": "Other Pipeline Transportation", + "related": [ + { + "dest-uuid": "417053d7-3c48-436a-b1da-8cb216c48c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e071f15c-595b-45fe-aa32-b7de9321aedf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "095cb039-067c-4d27-80ac-57d4bfbe128c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6a378598-37fe-4cc6-be23-9946693b5152", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5dd24f67-f3a8-4e76-ba4e-1894fdd8f03f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "180044a7-668f-42aa-9298-ed87d0b200da", + "value": "4869" + }, + { + "description": "Pipeline Transportation of Refined Petroleum Products", + "related": [ + { + "dest-uuid": "180044a7-668f-42aa-9298-ed87d0b200da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "095cb039-067c-4d27-80ac-57d4bfbe128c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e071f15c-595b-45fe-aa32-b7de9321aedf", + "value": "48691" + }, + { + "description": "Pipeline Transportation of Refined Petroleum Products", + "related": [ + { + "dest-uuid": "180044a7-668f-42aa-9298-ed87d0b200da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e071f15c-595b-45fe-aa32-b7de9321aedf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "095cb039-067c-4d27-80ac-57d4bfbe128c", + "value": "486910" + }, + { + "description": "All Other Pipeline Transportation", + "related": [ + { + "dest-uuid": "180044a7-668f-42aa-9298-ed87d0b200da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5dd24f67-f3a8-4e76-ba4e-1894fdd8f03f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6a378598-37fe-4cc6-be23-9946693b5152", + "value": "48699" + }, + { + "description": "All Other Pipeline Transportation", + "related": [ + { + "dest-uuid": "180044a7-668f-42aa-9298-ed87d0b200da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6a378598-37fe-4cc6-be23-9946693b5152", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5dd24f67-f3a8-4e76-ba4e-1894fdd8f03f", + "value": "486990" + }, + { + "description": "Scenic and Sightseeing Transportation", + "related": [ + { + "dest-uuid": "31803a82-e28b-420c-9463-03d3d09a5bf5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f9b43f7c-0a5b-4643-bf03-d06fbb23a8fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e1233898-8065-4931-acf1-02988cc6e829", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9b7c8d0c-22b3-437e-b55a-547069559dbb", + "value": "487" + }, + { + "description": "Scenic and Sightseeing Transportation, Land", + "related": [ + { + "dest-uuid": "9b7c8d0c-22b3-437e-b55a-547069559dbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f1fe1f61-6de6-42e5-88f8-eb28e2eac21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4b2d0c0b-2392-40b2-a00f-804c47c1b771", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "31803a82-e28b-420c-9463-03d3d09a5bf5", + "value": "4871" + }, + { + "description": "Scenic and Sightseeing Transportation, Land", + "related": [ + { + "dest-uuid": "31803a82-e28b-420c-9463-03d3d09a5bf5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4b2d0c0b-2392-40b2-a00f-804c47c1b771", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f1fe1f61-6de6-42e5-88f8-eb28e2eac21f", + "value": "48711" + }, + { + "description": "Scenic and Sightseeing Transportation, Land", + "related": [ + { + "dest-uuid": "31803a82-e28b-420c-9463-03d3d09a5bf5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f1fe1f61-6de6-42e5-88f8-eb28e2eac21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4b2d0c0b-2392-40b2-a00f-804c47c1b771", + "value": "487110" + }, + { + "description": "Scenic and Sightseeing Transportation, Water", + "related": [ + { + "dest-uuid": "9b7c8d0c-22b3-437e-b55a-547069559dbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c6cc9bd6-edcf-46b1-8fb1-00ac76e21219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "523e7c84-ec4c-4700-860e-0feebdfa7e37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f9b43f7c-0a5b-4643-bf03-d06fbb23a8fa", + "value": "4872" + }, + { + "description": "Scenic and Sightseeing Transportation, Water", + "related": [ + { + "dest-uuid": "f9b43f7c-0a5b-4643-bf03-d06fbb23a8fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "523e7c84-ec4c-4700-860e-0feebdfa7e37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c6cc9bd6-edcf-46b1-8fb1-00ac76e21219", + "value": "48721" + }, + { + "description": "Scenic and Sightseeing Transportation, Water", + "related": [ + { + "dest-uuid": "f9b43f7c-0a5b-4643-bf03-d06fbb23a8fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c6cc9bd6-edcf-46b1-8fb1-00ac76e21219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "523e7c84-ec4c-4700-860e-0feebdfa7e37", + "value": "487210" + }, + { + "description": "Scenic and Sightseeing Transportation, Other", + "related": [ + { + "dest-uuid": "9b7c8d0c-22b3-437e-b55a-547069559dbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "685b99d8-7e90-4330-849f-db923117ecea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7ad42f11-2035-4758-922e-87921bf36e97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e1233898-8065-4931-acf1-02988cc6e829", + "value": "4879" + }, + { + "description": "Scenic and Sightseeing Transportation, Other", + "related": [ + { + "dest-uuid": "e1233898-8065-4931-acf1-02988cc6e829", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7ad42f11-2035-4758-922e-87921bf36e97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "685b99d8-7e90-4330-849f-db923117ecea", + "value": "48799" + }, + { + "description": "Scenic and Sightseeing Transportation, Other", + "related": [ + { + "dest-uuid": "e1233898-8065-4931-acf1-02988cc6e829", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "685b99d8-7e90-4330-849f-db923117ecea", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7ad42f11-2035-4758-922e-87921bf36e97", + "value": "487990" + }, + { + "description": "Support Activities for Transportation", + "related": [ + { + "dest-uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "46f4c721-e40d-4cfb-97b6-db640b09589b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "75f80450-de18-436e-b585-62231d78c326", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "50f1254f-63b0-4073-a3bd-dc5da035b07b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cde7588d-c7df-48fa-840d-98a490e4e853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1503e6d0-730b-4b3e-92f9-09fb803e78f7", + "value": "488" + }, + { + "description": "Support Activities for Air Transportation", + "related": [ + { + "dest-uuid": "1503e6d0-730b-4b3e-92f9-09fb803e78f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1c5d61fc-9515-40eb-8666-83f560f1534d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4a6c03c5-c25b-4239-acaa-9f90cfaf1a03", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4219ba72-3851-47c8-8695-103bdd5d7643", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dd6b791b-d528-4410-9cbf-0deb7e44b2d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "79e5d5d3-521c-4ca6-a1c9-f6af9b7cb818", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", + "value": "4881" + }, + { + "description": "Airport Operations", + "related": [ + { + "dest-uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1c5d61fc-9515-40eb-8666-83f560f1534d", + "value": "48811" + }, + { + "description": "Air Traffic Control", + "related": [ + { + "dest-uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4a6c03c5-c25b-4239-acaa-9f90cfaf1a03", + "value": "488111" + }, + { + "description": "Other Airport Operations ", + "related": [ + { + "dest-uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4219ba72-3851-47c8-8695-103bdd5d7643", + "value": "488119" + }, + { + "description": "Other Support Activities for Air Transportation", + "related": [ + { + "dest-uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "79e5d5d3-521c-4ca6-a1c9-f6af9b7cb818", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dd6b791b-d528-4410-9cbf-0deb7e44b2d4", + "value": "48819" + }, + { + "description": "Other Support Activities for Air Transportation", + "related": [ + { + "dest-uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dd6b791b-d528-4410-9cbf-0deb7e44b2d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "79e5d5d3-521c-4ca6-a1c9-f6af9b7cb818", + "value": "488190" + }, + { + "description": "Support Activities for Rail Transportation", + "related": [ + { + "dest-uuid": "1503e6d0-730b-4b3e-92f9-09fb803e78f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "37d4015d-285b-4792-9916-8857a9a76624", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ac0e137f-c6a7-462f-a553-6642bf87f0fe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "46f4c721-e40d-4cfb-97b6-db640b09589b", + "value": "4882" + }, + { + "description": "Support Activities for Rail Transportation", + "related": [ + { + "dest-uuid": "46f4c721-e40d-4cfb-97b6-db640b09589b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ac0e137f-c6a7-462f-a553-6642bf87f0fe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "37d4015d-285b-4792-9916-8857a9a76624", + "value": "48821" + }, + { + "description": "Support Activities for Rail Transportation", + "related": [ + { + "dest-uuid": "46f4c721-e40d-4cfb-97b6-db640b09589b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "37d4015d-285b-4792-9916-8857a9a76624", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ac0e137f-c6a7-462f-a553-6642bf87f0fe", + "value": "488210" + }, + { + "description": "Support Activities for Water Transportation", + "related": [ + { + "dest-uuid": "1503e6d0-730b-4b3e-92f9-09fb803e78f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c3ad740e-e64e-4067-910a-cf681b2f9b71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b5baded7-15ce-43c2-a0b0-58e9912ff72e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c3f844ae-8fe2-4158-a797-9cea91d1a52a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b0638805-499b-4c4b-8927-a63085690c75", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5370f6ee-21bf-4bf2-ba7d-14e263d904cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ef9d1568-fec1-41c4-afe9-4b36c6e94234", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bbbcf940-ee88-496d-8fce-42e195f94ca3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2b7cb0b4-28a3-485c-8449-67f0ba60c1e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "value": "4883" + }, + { + "description": "Port and Harbor Operations", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b5baded7-15ce-43c2-a0b0-58e9912ff72e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c3ad740e-e64e-4067-910a-cf681b2f9b71", + "value": "48831" + }, + { + "description": "Port and Harbor Operations", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c3ad740e-e64e-4067-910a-cf681b2f9b71", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b5baded7-15ce-43c2-a0b0-58e9912ff72e", + "value": "488310" + }, + { + "description": "Marine Cargo Handling", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b0638805-499b-4c4b-8927-a63085690c75", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c3f844ae-8fe2-4158-a797-9cea91d1a52a", + "value": "48832" + }, + { + "description": "Marine Cargo Handling", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c3f844ae-8fe2-4158-a797-9cea91d1a52a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b0638805-499b-4c4b-8927-a63085690c75", + "value": "488320" + }, + { + "description": "Navigational Services to Shipping", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ef9d1568-fec1-41c4-afe9-4b36c6e94234", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5370f6ee-21bf-4bf2-ba7d-14e263d904cc", + "value": "48833" + }, + { + "description": "Navigational Services to Shipping ", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5370f6ee-21bf-4bf2-ba7d-14e263d904cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ef9d1568-fec1-41c4-afe9-4b36c6e94234", + "value": "488330" + }, + { + "description": "Other Support Activities for Water Transportation", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b7cb0b4-28a3-485c-8449-67f0ba60c1e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bbbcf940-ee88-496d-8fce-42e195f94ca3", + "value": "48839" + }, + { + "description": "Other Support Activities for Water Transportation", + "related": [ + { + "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bbbcf940-ee88-496d-8fce-42e195f94ca3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2b7cb0b4-28a3-485c-8449-67f0ba60c1e6", + "value": "488390" + }, + { + "description": "Support Activities for Road Transportation", + "related": [ + { + "dest-uuid": "1503e6d0-730b-4b3e-92f9-09fb803e78f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b4f783c2-4dd4-4624-a3f7-5cd845d48a52", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "00c0bc7e-14a3-4aa2-bd19-3656aba34541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4dd18e02-af20-427e-a73f-50293339e9a9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dafb6fcc-a963-42fd-a2b4-5591e28e9780", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "75f80450-de18-436e-b585-62231d78c326", + "value": "4884" + }, + { + "description": "Motor Vehicle Towing", + "related": [ + { + "dest-uuid": "75f80450-de18-436e-b585-62231d78c326", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "00c0bc7e-14a3-4aa2-bd19-3656aba34541", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b4f783c2-4dd4-4624-a3f7-5cd845d48a52", + "value": "48841" + }, + { + "description": "Motor Vehicle Towing", + "related": [ + { + "dest-uuid": "75f80450-de18-436e-b585-62231d78c326", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b4f783c2-4dd4-4624-a3f7-5cd845d48a52", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "00c0bc7e-14a3-4aa2-bd19-3656aba34541", + "value": "488410" + }, + { + "description": "Other Support Activities for Road Transportation", + "related": [ + { + "dest-uuid": "75f80450-de18-436e-b585-62231d78c326", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dafb6fcc-a963-42fd-a2b4-5591e28e9780", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4dd18e02-af20-427e-a73f-50293339e9a9", + "value": "48849" + }, + { + "description": "Other Support Activities for Road Transportation ", + "related": [ + { + "dest-uuid": "75f80450-de18-436e-b585-62231d78c326", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4dd18e02-af20-427e-a73f-50293339e9a9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dafb6fcc-a963-42fd-a2b4-5591e28e9780", + "value": "488490" + }, + { + "description": "Freight Transportation Arrangement", + "related": [ + { + "dest-uuid": "1503e6d0-730b-4b3e-92f9-09fb803e78f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9be4aa4b-e1dc-4f3f-bc56-0211b8db21a5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "abbf002a-1694-4c22-b160-48db351966ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "50f1254f-63b0-4073-a3bd-dc5da035b07b", + "value": "4885" + }, + { + "description": "Freight Transportation Arrangement", + "related": [ + { + "dest-uuid": "50f1254f-63b0-4073-a3bd-dc5da035b07b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "abbf002a-1694-4c22-b160-48db351966ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9be4aa4b-e1dc-4f3f-bc56-0211b8db21a5", + "value": "48851" + }, + { + "description": "Freight Transportation Arrangement ", + "related": [ + { + "dest-uuid": "50f1254f-63b0-4073-a3bd-dc5da035b07b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9be4aa4b-e1dc-4f3f-bc56-0211b8db21a5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "abbf002a-1694-4c22-b160-48db351966ef", + "value": "488510" + }, + { + "description": "Other Support Activities for Transportation", + "related": [ + { + "dest-uuid": "1503e6d0-730b-4b3e-92f9-09fb803e78f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2a417780-6aca-4c4b-8001-fdbe15a9009c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "94f72cdf-a485-4b8b-9cf6-4108f93e0543", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "40ad38d2-852d-4a88-9a7a-2d82ed274bed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cde7588d-c7df-48fa-840d-98a490e4e853", + "value": "4889" + }, + { + "description": "Other Support Activities for Transportation", + "related": [ + { + "dest-uuid": "cde7588d-c7df-48fa-840d-98a490e4e853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2a417780-6aca-4c4b-8001-fdbe15a9009c", + "value": "48899" + }, + { + "description": "Packing and Crating ", + "related": [ + { + "dest-uuid": "cde7588d-c7df-48fa-840d-98a490e4e853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "94f72cdf-a485-4b8b-9cf6-4108f93e0543", + "value": "488991" + }, + { + "description": "All Other Support Activities for Transportation ", + "related": [ + { + "dest-uuid": "cde7588d-c7df-48fa-840d-98a490e4e853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "40ad38d2-852d-4a88-9a7a-2d82ed274bed", + "value": "488999" + }, + { + "description": "Postal Service", + "related": [ + { + "dest-uuid": "6af64d6d-61e9-4b71-af9b-d296a4a117e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "95c5384c-03d7-4c82-854f-8566b325611d", + "value": "491" + }, + { + "description": "Postal Service", + "related": [ + { + "dest-uuid": "95c5384c-03d7-4c82-854f-8566b325611d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1aac3bcf-39c4-4cc2-b77b-fdb2a997d4df", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ddb52623-7ddb-44cf-ba99-0ade01fff250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6af64d6d-61e9-4b71-af9b-d296a4a117e8", + "value": "4911" + }, + { + "description": "Postal Service", + "related": [ + { + "dest-uuid": "6af64d6d-61e9-4b71-af9b-d296a4a117e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddb52623-7ddb-44cf-ba99-0ade01fff250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1aac3bcf-39c4-4cc2-b77b-fdb2a997d4df", + "value": "49111" + }, + { + "description": "Postal Service", + "related": [ + { + "dest-uuid": "6af64d6d-61e9-4b71-af9b-d296a4a117e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1aac3bcf-39c4-4cc2-b77b-fdb2a997d4df", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ddb52623-7ddb-44cf-ba99-0ade01fff250", + "value": "491110" + }, + { + "description": "Couriers and Messengers", + "related": [ + { + "dest-uuid": "9a8f4c5d-7921-469e-a234-f726a4affdfa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8f0412c9-4fcb-4f2a-ae53-2d35ed343d2f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "95864c44-0e0b-4be6-a9d7-78c6540846ae", + "value": "492" + }, + { + "description": "Couriers and Express Delivery Services", + "related": [ + { + "dest-uuid": "95864c44-0e0b-4be6-a9d7-78c6540846ae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2cc2bf74-5607-4ff5-bfb9-78e134a8fdcb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "46350699-888e-4ede-a6c1-79952ee638ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9a8f4c5d-7921-469e-a234-f726a4affdfa", + "value": "4921" + }, + { + "description": "Couriers and Express Delivery Services", + "related": [ + { + "dest-uuid": "9a8f4c5d-7921-469e-a234-f726a4affdfa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "46350699-888e-4ede-a6c1-79952ee638ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2cc2bf74-5607-4ff5-bfb9-78e134a8fdcb", + "value": "49211" + }, + { + "description": "Couriers and Express Delivery Services", + "related": [ + { + "dest-uuid": "9a8f4c5d-7921-469e-a234-f726a4affdfa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2cc2bf74-5607-4ff5-bfb9-78e134a8fdcb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "46350699-888e-4ede-a6c1-79952ee638ed", + "value": "492110" + }, + { + "description": "Local Messengers and Local Delivery", + "related": [ + { + "dest-uuid": "95864c44-0e0b-4be6-a9d7-78c6540846ae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "56f584b2-4478-47c2-bd6f-f3c350b70422", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "65ee0656-daa0-4a9c-9758-3c4b1a411da5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8f0412c9-4fcb-4f2a-ae53-2d35ed343d2f", + "value": "4922" + }, + { + "description": "Local Messengers and Local Delivery", + "related": [ + { + "dest-uuid": "8f0412c9-4fcb-4f2a-ae53-2d35ed343d2f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "65ee0656-daa0-4a9c-9758-3c4b1a411da5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "56f584b2-4478-47c2-bd6f-f3c350b70422", + "value": "49221" + }, + { + "description": "Local Messengers and Local Delivery", + "related": [ + { + "dest-uuid": "8f0412c9-4fcb-4f2a-ae53-2d35ed343d2f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "56f584b2-4478-47c2-bd6f-f3c350b70422", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "65ee0656-daa0-4a9c-9758-3c4b1a411da5", + "value": "492210" + }, + { + "description": "Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "db9f26a5-dd6d-4615-838b-113c4f3d8a5a", + "value": "493" + }, + { + "description": "Warehousing and Storage", + "related": [ + { + "dest-uuid": "db9f26a5-dd6d-4615-838b-113c4f3d8a5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a3be3e9-85b7-45a3-b98c-d04fb8422afc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4a7cfe67-fe9a-4ea2-b0bf-9f462202a664", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c10f5e6-c3b9-4112-9b65-3c3781761292", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "52f8294e-39c2-4e15-bbab-8c7ebae6b173", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "318fdcb2-2ee5-46b6-8eab-4d930cbd3116", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b1163b29-176b-4f1b-9656-c1d2320bb46d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "330ed4d5-25ef-48f0-bfdb-d64b2881a129", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fdb59546-c524-48dc-ac25-884e6fb9c238", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "value": "4931" + }, + { + "description": "General Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4a7cfe67-fe9a-4ea2-b0bf-9f462202a664", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3a3be3e9-85b7-45a3-b98c-d04fb8422afc", + "value": "49311" + }, + { + "description": "General Warehousing and Storage ", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a3be3e9-85b7-45a3-b98c-d04fb8422afc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4a7cfe67-fe9a-4ea2-b0bf-9f462202a664", + "value": "493110" + }, + { + "description": "Refrigerated Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "52f8294e-39c2-4e15-bbab-8c7ebae6b173", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c10f5e6-c3b9-4112-9b65-3c3781761292", + "value": "49312" + }, + { + "description": "Refrigerated Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c10f5e6-c3b9-4112-9b65-3c3781761292", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "52f8294e-39c2-4e15-bbab-8c7ebae6b173", + "value": "493120" + }, + { + "description": "Farm Product Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b1163b29-176b-4f1b-9656-c1d2320bb46d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "318fdcb2-2ee5-46b6-8eab-4d930cbd3116", + "value": "49313" + }, + { + "description": "Farm Product Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "318fdcb2-2ee5-46b6-8eab-4d930cbd3116", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b1163b29-176b-4f1b-9656-c1d2320bb46d", + "value": "493130" + }, + { + "description": "Other Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fdb59546-c524-48dc-ac25-884e6fb9c238", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "330ed4d5-25ef-48f0-bfdb-d64b2881a129", + "value": "49319" + }, + { + "description": "Other Warehousing and Storage", + "related": [ + { + "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "330ed4d5-25ef-48f0-bfdb-d64b2881a129", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fdb59546-c524-48dc-ac25-884e6fb9c238", + "value": "493190" + }, + { + "description": "Information", + "related": [ + { + "dest-uuid": "934c4aa4-27d6-4298-bb8a-e610edc9d2a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cfbe4d8b-ec61-4765-88a8-c4630805f871", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4897724f-4b98-4349-919b-a097e88a8e6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "35004608-030b-4823-be6b-90f0f044f88f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6632beff-4928-4acb-8d7f-b24af36d4046", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "08d64975-0176-40f6-aded-6ef251b4991b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "57ea3e3f-eb96-4fe2-8d0f-58ea9fd321ca", + "value": "51" + }, + { + "description": "Motion Picture and Sound Recording Industries", + "related": [ + { + "dest-uuid": "57ea3e3f-eb96-4fe2-8d0f-58ea9fd321ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "934c4aa4-27d6-4298-bb8a-e610edc9d2a0", + "value": "512" + }, + { + "description": "Motion Picture and Video Industries", + "related": [ + { + "dest-uuid": "934c4aa4-27d6-4298-bb8a-e610edc9d2a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4b62cc2b-9ccb-4414-8892-744d624e3127", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "04967ab9-b4c4-4c0f-a3fd-45f9208bd48f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b32cc188-72cb-4c03-a4b7-9f6e7856ca21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "63ece6e5-25bd-4dc9-b004-803e44fa0920", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "01ebda3b-480c-4864-8d3e-d25e8c3e6219", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "21cf25dd-fbea-41cd-9831-0eff0f8b0b1e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b76ca48a-bf43-4b9a-baa3-a15d56fe9027", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "943ffc42-cfb9-4f78-8d17-66d2bebb34b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3e01dbce-3555-4c95-843b-0b3cd12bb772", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2bf71412-bb88-4847-8b68-160df1d93493", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "value": "5121" + }, + { + "description": "Motion Picture and Video Production", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "04967ab9-b4c4-4c0f-a3fd-45f9208bd48f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4b62cc2b-9ccb-4414-8892-744d624e3127", + "value": "51211" + }, + { + "description": "Motion Picture and Video Production ", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4b62cc2b-9ccb-4414-8892-744d624e3127", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "04967ab9-b4c4-4c0f-a3fd-45f9208bd48f", + "value": "512110" + }, + { + "description": "Motion Picture and Video Distribution", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "63ece6e5-25bd-4dc9-b004-803e44fa0920", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b32cc188-72cb-4c03-a4b7-9f6e7856ca21", + "value": "51212" + }, + { + "description": "Motion Picture and Video Distribution", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b32cc188-72cb-4c03-a4b7-9f6e7856ca21", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "63ece6e5-25bd-4dc9-b004-803e44fa0920", + "value": "512120" + }, + { + "description": "Motion Picture and Video Exhibition", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "01ebda3b-480c-4864-8d3e-d25e8c3e6219", + "value": "51213" + }, + { + "description": "Motion Picture Theaters (except Drive-Ins) ", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "21cf25dd-fbea-41cd-9831-0eff0f8b0b1e", + "value": "512131" + }, + { + "description": "Drive-In Motion Picture Theaters ", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b76ca48a-bf43-4b9a-baa3-a15d56fe9027", + "value": "512132" + }, + { + "description": "Postproduction Services and Other Motion Picture and Video Industries", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "943ffc42-cfb9-4f78-8d17-66d2bebb34b9", + "value": "51219" + }, + { + "description": "Teleproduction and Other Postproduction Services ", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3e01dbce-3555-4c95-843b-0b3cd12bb772", + "value": "512191" + }, + { + "description": "Other Motion Picture and Video Industries ", + "related": [ + { + "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2bf71412-bb88-4847-8b68-160df1d93493", + "value": "512199" + }, + { + "description": "Sound Recording Industries", + "related": [ + { + "dest-uuid": "934c4aa4-27d6-4298-bb8a-e610edc9d2a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8fb8ac66-5053-4e79-a734-cb78369e0839", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "753957ad-ac67-40f0-af91-03e873346528", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a9284f07-6b8b-4182-a954-b2bddacf3c1a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5008494c-4356-41b5-b5b2-82ce543e2649", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3ea392f2-40a4-4b0b-979f-2b90f16460b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "67649f41-0ef8-4ec3-bb72-1d5acecd664c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1b14f1c9-ebb7-4bfc-9ce2-bfe2c3e5f6bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "283d2586-00b4-4ead-b52c-d00a6ca35ca3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "value": "5122" + }, + { + "description": "Music Publishers", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "753957ad-ac67-40f0-af91-03e873346528", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8fb8ac66-5053-4e79-a734-cb78369e0839", + "value": "51223" + }, + { + "description": "Music Publishers", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8fb8ac66-5053-4e79-a734-cb78369e0839", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "753957ad-ac67-40f0-af91-03e873346528", + "value": "512230" + }, + { + "description": "Sound Recording Studios", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5008494c-4356-41b5-b5b2-82ce543e2649", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a9284f07-6b8b-4182-a954-b2bddacf3c1a", + "value": "51224" + }, + { + "description": "Sound Recording Studios", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a9284f07-6b8b-4182-a954-b2bddacf3c1a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5008494c-4356-41b5-b5b2-82ce543e2649", + "value": "512240" + }, + { + "description": "Record Production and Distribution", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "67649f41-0ef8-4ec3-bb72-1d5acecd664c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3ea392f2-40a4-4b0b-979f-2b90f16460b4", + "value": "51225" + }, + { + "description": "Record Production and Distribution", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3ea392f2-40a4-4b0b-979f-2b90f16460b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "67649f41-0ef8-4ec3-bb72-1d5acecd664c", + "value": "512250" + }, + { + "description": "Other Sound Recording Industries", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "283d2586-00b4-4ead-b52c-d00a6ca35ca3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1b14f1c9-ebb7-4bfc-9ce2-bfe2c3e5f6bb", + "value": "51229" + }, + { + "description": "Other Sound Recording Industries", + "related": [ + { + "dest-uuid": "c5f8d604-08b2-490f-99e1-6ca3d153fd09", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1b14f1c9-ebb7-4bfc-9ce2-bfe2c3e5f6bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "283d2586-00b4-4ead-b52c-d00a6ca35ca3", + "value": "512290" + }, + { + "description": "Publishing Industries", + "related": [ + { + "dest-uuid": "57ea3e3f-eb96-4fe2-8d0f-58ea9fd321ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bb8d8275-979b-4b51-bfcc-3d33413468c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cfbe4d8b-ec61-4765-88a8-c4630805f871", + "value": "513" + }, + { + "description": "Newspaper, Periodical, Book, and Directory Publishers", + "related": [ + { + "dest-uuid": "cfbe4d8b-ec61-4765-88a8-c4630805f871", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddea3ce9-a167-4823-af3e-b0043b272195", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "949d02d4-d1e5-4a5a-9f7f-25b97abea877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "66d6d8c3-76e8-4a23-941f-2983b239b04a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d9cc88a-1801-4a9b-aa0b-d611af64a877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a6e94dd6-6197-448e-8a5c-ff1a30b27710", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4ba691b8-aa5c-49bd-ad54-f7bb55e28154", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eff63585-6f0b-47c4-a414-6cb09d574eb9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a806d4ec-64e3-476e-97ce-8eaa7f85fccc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "597b50db-f305-4e13-9c88-cc42cad4592d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c0acbba5-bb73-4913-b2f4-765bc1d1bfde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "faf93e8d-8bc8-4e75-879f-d0ad31d2fc3c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "value": "5131" + }, + { + "description": "Newspaper Publishers", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "949d02d4-d1e5-4a5a-9f7f-25b97abea877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ddea3ce9-a167-4823-af3e-b0043b272195", + "value": "51311" + }, + { + "description": "Newspaper Publishers ", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddea3ce9-a167-4823-af3e-b0043b272195", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "949d02d4-d1e5-4a5a-9f7f-25b97abea877", + "value": "513110" + }, + { + "description": "Periodical Publishers", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3d9cc88a-1801-4a9b-aa0b-d611af64a877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "66d6d8c3-76e8-4a23-941f-2983b239b04a", + "value": "51312" + }, + { + "description": "Periodical Publishers ", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "66d6d8c3-76e8-4a23-941f-2983b239b04a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3d9cc88a-1801-4a9b-aa0b-d611af64a877", + "value": "513120" + }, + { + "description": "Book Publishers", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4ba691b8-aa5c-49bd-ad54-f7bb55e28154", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a6e94dd6-6197-448e-8a5c-ff1a30b27710", + "value": "51313" + }, + { + "description": "Book Publishers ", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a6e94dd6-6197-448e-8a5c-ff1a30b27710", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4ba691b8-aa5c-49bd-ad54-f7bb55e28154", + "value": "513130" + }, + { + "description": "Directory and Mailing List Publishers", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a806d4ec-64e3-476e-97ce-8eaa7f85fccc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eff63585-6f0b-47c4-a414-6cb09d574eb9", + "value": "51314" + }, + { + "description": "Directory and Mailing List Publishers ", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eff63585-6f0b-47c4-a414-6cb09d574eb9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a806d4ec-64e3-476e-97ce-8eaa7f85fccc", + "value": "513140" + }, + { + "description": "Other Publishers", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "597b50db-f305-4e13-9c88-cc42cad4592d", + "value": "51319" + }, + { + "description": "Greeting Card Publishers ", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c0acbba5-bb73-4913-b2f4-765bc1d1bfde", + "value": "513191" + }, + { + "description": "All Other Publishers ", + "related": [ + { + "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "faf93e8d-8bc8-4e75-879f-d0ad31d2fc3c", + "value": "513199" + }, + { + "description": "Software Publishers", + "related": [ + { + "dest-uuid": "cfbe4d8b-ec61-4765-88a8-c4630805f871", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a62fd1e8-8647-4a16-a1a3-c984884dc104", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d6e71a6a-5974-490d-a09d-d405dcfd2cef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bb8d8275-979b-4b51-bfcc-3d33413468c3", + "value": "5132" + }, + { + "description": "Software Publishers", + "related": [ + { + "dest-uuid": "bb8d8275-979b-4b51-bfcc-3d33413468c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d6e71a6a-5974-490d-a09d-d405dcfd2cef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a62fd1e8-8647-4a16-a1a3-c984884dc104", + "value": "51321" + }, + { + "description": "Software Publishers", + "related": [ + { + "dest-uuid": "bb8d8275-979b-4b51-bfcc-3d33413468c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a62fd1e8-8647-4a16-a1a3-c984884dc104", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d6e71a6a-5974-490d-a09d-d405dcfd2cef", + "value": "513210" + }, + { + "description": "Broadcasting and Content Providers", + "related": [ + { + "dest-uuid": "57ea3e3f-eb96-4fe2-8d0f-58ea9fd321ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "51805c94-98a4-454c-8dba-f5f40a6eed8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "31b271db-615e-4a2c-82e8-073b76766176", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4897724f-4b98-4349-919b-a097e88a8e6d", + "value": "516" + }, + { + "description": "Radio and Television Broadcasting Stations", + "related": [ + { + "dest-uuid": "4897724f-4b98-4349-919b-a097e88a8e6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "357a6f0a-a1a4-4645-b76a-ecc3ce2e731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "01bc6875-7341-4183-8177-74df2519aec1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7978daba-a489-47c7-b3ed-56ad8c98291e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f7a96d68-46cf-4e1c-b963-8db74d5bd878", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "51805c94-98a4-454c-8dba-f5f40a6eed8f", + "value": "5161" + }, + { + "description": "Radio Broadcasting Stations", + "related": [ + { + "dest-uuid": "51805c94-98a4-454c-8dba-f5f40a6eed8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "01bc6875-7341-4183-8177-74df2519aec1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "357a6f0a-a1a4-4645-b76a-ecc3ce2e731f", + "value": "51611" + }, + { + "description": "Radio Broadcasting Stations ", + "related": [ + { + "dest-uuid": "51805c94-98a4-454c-8dba-f5f40a6eed8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "357a6f0a-a1a4-4645-b76a-ecc3ce2e731f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "01bc6875-7341-4183-8177-74df2519aec1", + "value": "516110" + }, + { + "description": "Television Broadcasting Stations", + "related": [ + { + "dest-uuid": "51805c94-98a4-454c-8dba-f5f40a6eed8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f7a96d68-46cf-4e1c-b963-8db74d5bd878", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7978daba-a489-47c7-b3ed-56ad8c98291e", + "value": "51612" + }, + { + "description": "Television Broadcasting Stations", + "related": [ + { + "dest-uuid": "51805c94-98a4-454c-8dba-f5f40a6eed8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7978daba-a489-47c7-b3ed-56ad8c98291e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f7a96d68-46cf-4e1c-b963-8db74d5bd878", + "value": "516120" + }, + { + "description": "Media Streaming Distribution Services, Social Networks, and Other Media Networks and Content Providers", + "related": [ + { + "dest-uuid": "4897724f-4b98-4349-919b-a097e88a8e6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e8626740-8a0d-47a4-897b-dac0b5ddbca3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4bb2060c-bce4-4d3e-b354-c41720a963a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "31b271db-615e-4a2c-82e8-073b76766176", + "value": "5162" + }, + { + "description": "Media Streaming Distribution Services, Social Networks, and Other Media Networks and Content Providers", + "related": [ + { + "dest-uuid": "31b271db-615e-4a2c-82e8-073b76766176", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4bb2060c-bce4-4d3e-b354-c41720a963a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e8626740-8a0d-47a4-897b-dac0b5ddbca3", + "value": "51621" + }, + { + "description": "Media Streaming Distribution Services, Social Networks, and Other Media Networks and Content Providers", + "related": [ + { + "dest-uuid": "31b271db-615e-4a2c-82e8-073b76766176", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e8626740-8a0d-47a4-897b-dac0b5ddbca3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4bb2060c-bce4-4d3e-b354-c41720a963a0", + "value": "516210" + }, + { + "description": "Telecommunications", + "related": [ + { + "dest-uuid": "57ea3e3f-eb96-4fe2-8d0f-58ea9fd321ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "09037fcf-a681-48ca-91ed-ee633a867443", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4f49488e-1aeb-4343-897d-50916a5cbdbe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "35004608-030b-4823-be6b-90f0f044f88f", + "value": "517" + }, + { + "description": "Wired and Wireless Telecommunications (except Satellite)", + "related": [ + { + "dest-uuid": "35004608-030b-4823-be6b-90f0f044f88f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f81e2a01-f084-428d-beac-2be07027f457", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0b6d785f-d57d-4d94-a80f-1e0ed67364ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4841cc72-ed9e-484d-bf1d-71ed01d086ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "316074f1-125f-4ca0-b862-47929df93343", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a69707d6-32d1-4724-8cc2-bfa8c7fa8ab6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "32a36d43-d21a-4145-bd15-f8a0a350cc90", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "value": "5171" + }, + { + "description": "Wired and Wireless Telecommunications Carriers (except Satellite)", + "related": [ + { + "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f81e2a01-f084-428d-beac-2be07027f457", + "value": "51711" + }, + { + "description": "Wired Telecommunications Carriers ", + "related": [ + { + "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0b6d785f-d57d-4d94-a80f-1e0ed67364ca", + "value": "517111" + }, + { + "description": "Wireless Telecommunications Carriers (except Satellite)", + "related": [ + { + "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4841cc72-ed9e-484d-bf1d-71ed01d086ac", + "value": "517112" + }, + { + "description": "Telecommunications Resellers and Agents for Wireless Telecommunication Services", + "related": [ + { + "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "316074f1-125f-4ca0-b862-47929df93343", + "value": "51712" + }, + { + "description": "Telecommunications Resellers", + "related": [ + { + "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a69707d6-32d1-4724-8cc2-bfa8c7fa8ab6", + "value": "517121" + }, + { + "description": "Agents for Wireless Telecommunications Services", + "related": [ + { + "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "32a36d43-d21a-4145-bd15-f8a0a350cc90", + "value": "517122" + }, + { + "description": "Satellite Telecommunications", + "related": [ + { + "dest-uuid": "35004608-030b-4823-be6b-90f0f044f88f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "27a65086-475b-43a5-9ce0-f9857d32b4bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3a5c7319-1e92-4195-ab07-19f1e55c871a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "09037fcf-a681-48ca-91ed-ee633a867443", + "value": "5174" + }, + { + "description": "Satellite Telecommunications", + "related": [ + { + "dest-uuid": "09037fcf-a681-48ca-91ed-ee633a867443", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a5c7319-1e92-4195-ab07-19f1e55c871a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "27a65086-475b-43a5-9ce0-f9857d32b4bf", + "value": "51741" + }, + { + "description": "Satellite Telecommunications", + "related": [ + { + "dest-uuid": "09037fcf-a681-48ca-91ed-ee633a867443", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "27a65086-475b-43a5-9ce0-f9857d32b4bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3a5c7319-1e92-4195-ab07-19f1e55c871a", + "value": "517410" + }, + { + "description": "All Other Telecommunications", + "related": [ + { + "dest-uuid": "35004608-030b-4823-be6b-90f0f044f88f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a82e5e6f-895f-4086-ba53-fe49a0dd3b33", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "204b3c63-9b3c-495a-9add-1e582d2aa688", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4f49488e-1aeb-4343-897d-50916a5cbdbe", + "value": "5178" + }, + { + "description": "All Other Telecommunications", + "related": [ + { + "dest-uuid": "4f49488e-1aeb-4343-897d-50916a5cbdbe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "204b3c63-9b3c-495a-9add-1e582d2aa688", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a82e5e6f-895f-4086-ba53-fe49a0dd3b33", + "value": "51781" + }, + { + "description": "All Other Telecommunications ", + "related": [ + { + "dest-uuid": "4f49488e-1aeb-4343-897d-50916a5cbdbe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a82e5e6f-895f-4086-ba53-fe49a0dd3b33", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "204b3c63-9b3c-495a-9add-1e582d2aa688", + "value": "517810" + }, + { + "description": "Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services", + "related": [ + { + "dest-uuid": "57ea3e3f-eb96-4fe2-8d0f-58ea9fd321ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0a54a9b1-0dbf-4a67-a919-6592d2cba6f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6632beff-4928-4acb-8d7f-b24af36d4046", + "value": "518" + }, + { + "description": "Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services", + "related": [ + { + "dest-uuid": "6632beff-4928-4acb-8d7f-b24af36d4046", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "719fc35d-2a8e-4df9-ac17-7ef8c31f9d2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1e4fc6c6-36b0-4786-bf9f-415bda4d982f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0a54a9b1-0dbf-4a67-a919-6592d2cba6f2", + "value": "5182" + }, + { + "description": "Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services", + "related": [ + { + "dest-uuid": "0a54a9b1-0dbf-4a67-a919-6592d2cba6f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1e4fc6c6-36b0-4786-bf9f-415bda4d982f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "719fc35d-2a8e-4df9-ac17-7ef8c31f9d2d", + "value": "51821" + }, + { + "description": "Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services", + "related": [ + { + "dest-uuid": "0a54a9b1-0dbf-4a67-a919-6592d2cba6f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "719fc35d-2a8e-4df9-ac17-7ef8c31f9d2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1e4fc6c6-36b0-4786-bf9f-415bda4d982f", + "value": "518210" + }, + { + "description": "Web Search Portals, Libraries, Archives, and Other Information Services", + "related": [ + { + "dest-uuid": "57ea3e3f-eb96-4fe2-8d0f-58ea9fd321ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f8953fa0-354b-40fb-8091-523a7ec8d045", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "08d64975-0176-40f6-aded-6ef251b4991b", + "value": "519" + }, + { + "description": "Web Search Portals, Libraries, Archives, and Other Information Services", + "related": [ + { + "dest-uuid": "08d64975-0176-40f6-aded-6ef251b4991b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "225244ce-89b9-49e9-a7db-6eccb1b4bbd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "932adf8b-2988-463f-9883-0a5bfc8f5bd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "829e1e6f-6d18-42bd-b14f-dd566aa4f0d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2a22659d-12b5-4840-9bc4-0594c7c2c798", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f8953fa0-354b-40fb-8091-523a7ec8d045", + "value": "5192" + }, + { + "description": "Libraries and Archives", + "related": [ + { + "dest-uuid": "f8953fa0-354b-40fb-8091-523a7ec8d045", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "932adf8b-2988-463f-9883-0a5bfc8f5bd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "225244ce-89b9-49e9-a7db-6eccb1b4bbd4", + "value": "51921" + }, + { + "description": "Libraries and Archives ", + "related": [ + { + "dest-uuid": "f8953fa0-354b-40fb-8091-523a7ec8d045", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "225244ce-89b9-49e9-a7db-6eccb1b4bbd4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "932adf8b-2988-463f-9883-0a5bfc8f5bd4", + "value": "519210" + }, + { + "description": "Web Search Portals and All Other Information Services", + "related": [ + { + "dest-uuid": "f8953fa0-354b-40fb-8091-523a7ec8d045", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2a22659d-12b5-4840-9bc4-0594c7c2c798", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "829e1e6f-6d18-42bd-b14f-dd566aa4f0d4", + "value": "51929" + }, + { + "description": "Web Search Portals and All Other Information Services", + "related": [ + { + "dest-uuid": "f8953fa0-354b-40fb-8091-523a7ec8d045", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "829e1e6f-6d18-42bd-b14f-dd566aa4f0d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2a22659d-12b5-4840-9bc4-0594c7c2c798", + "value": "519290" + }, + { + "description": "Finance and Insurance", + "related": [ + { + "dest-uuid": "da1b50a5-a794-49ec-965b-6117573ad25d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ec7a05b3-466e-4db1-906d-1bbe7bc04371", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fdd18e97-66ac-4db4-a511-4ab4e56361ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8769d32f-a13e-413c-b6fb-ad79ac758ec8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5b5670b9-0302-4d25-b1a0-a813e8a2e07d", + "value": "52" + }, + { + "description": "Monetary Authorities-Central Bank", + "related": [ + { + "dest-uuid": "5b5670b9-0302-4d25-b1a0-a813e8a2e07d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c5f425a3-ae02-4686-9d7b-330a8da03c59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "da1b50a5-a794-49ec-965b-6117573ad25d", + "value": "521" + }, + { + "description": "Monetary Authorities-Central Bank", + "related": [ + { + "dest-uuid": "da1b50a5-a794-49ec-965b-6117573ad25d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3d3cc7ae-3bb5-48d6-b2b2-599a3c359c1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e6c99536-965b-43bc-8147-6781b9364d1a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c5f425a3-ae02-4686-9d7b-330a8da03c59", + "value": "5211" + }, + { + "description": "Monetary Authorities-Central Bank", + "related": [ + { + "dest-uuid": "c5f425a3-ae02-4686-9d7b-330a8da03c59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e6c99536-965b-43bc-8147-6781b9364d1a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3d3cc7ae-3bb5-48d6-b2b2-599a3c359c1c", + "value": "52111" + }, + { + "description": "Monetary Authorities-Central Bank", + "related": [ + { + "dest-uuid": "c5f425a3-ae02-4686-9d7b-330a8da03c59", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3d3cc7ae-3bb5-48d6-b2b2-599a3c359c1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e6c99536-965b-43bc-8147-6781b9364d1a", + "value": "521110" + }, + { + "description": "Credit Intermediation and Related Activities", + "related": [ + { + "dest-uuid": "5b5670b9-0302-4d25-b1a0-a813e8a2e07d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", + "value": "522" + }, + { + "description": "Depository Credit Intermediation ", + "related": [ + { + "dest-uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "70c40de2-731a-463b-95f8-6651da8622c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "34b5628b-fdc6-4ff8-98d1-b638ff7066a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b2355687-0fb1-45b9-b54d-619fd01be651", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a6e92a35-c756-4735-874d-9409b358f86d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4810fcf3-2e87-40d1-bc50-8ad0195fe50e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "332f344b-2d46-4036-9d82-3d5070c81796", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "value": "5221" + }, + { + "description": "Commercial Banking ", + "related": [ + { + "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "34b5628b-fdc6-4ff8-98d1-b638ff7066a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "70c40de2-731a-463b-95f8-6651da8622c9", + "value": "52211" + }, + { + "description": "Commercial Banking ", + "related": [ + { + "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "70c40de2-731a-463b-95f8-6651da8622c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "34b5628b-fdc6-4ff8-98d1-b638ff7066a3", + "value": "522110" + }, + { + "description": "Credit Unions ", + "related": [ + { + "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a6e92a35-c756-4735-874d-9409b358f86d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b2355687-0fb1-45b9-b54d-619fd01be651", + "value": "52213" + }, + { + "description": "Credit Unions ", + "related": [ + { + "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b2355687-0fb1-45b9-b54d-619fd01be651", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a6e92a35-c756-4735-874d-9409b358f86d", + "value": "522130" + }, + { + "description": "Savings Institutions and Other Depository Credit Intermediation ", + "related": [ + { + "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "332f344b-2d46-4036-9d82-3d5070c81796", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4810fcf3-2e87-40d1-bc50-8ad0195fe50e", + "value": "52218" + }, + { + "description": "Savings Institutions and Other Depository Credit Intermediation ", + "related": [ + { + "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4810fcf3-2e87-40d1-bc50-8ad0195fe50e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "332f344b-2d46-4036-9d82-3d5070c81796", + "value": "522180" + }, + { + "description": "Nondepository Credit Intermediation ", + "related": [ + { + "dest-uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "84215bf1-5108-45cd-b223-41c6b5b2e59a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "63b1bd4d-dce5-4ac8-a7dd-e14585efdc41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "152b25df-9952-4a15-8a2a-6aa4f2871d61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d6870dc5-4eec-4938-bdcc-96c99029a8f1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c3523ac2-e330-4972-98a8-0e44ed30186e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f58ed61d-8e72-47b7-98b5-c52190c956e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "216cb5ed-bff8-42f7-8cf3-e8c4baaef27a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7b06da94-6b38-4d94-9217-388c34d5896f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "value": "5222" + }, + { + "description": "Credit Card Issuing ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "63b1bd4d-dce5-4ac8-a7dd-e14585efdc41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "84215bf1-5108-45cd-b223-41c6b5b2e59a", + "value": "52221" + }, + { + "description": "Credit Card Issuing ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "84215bf1-5108-45cd-b223-41c6b5b2e59a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "63b1bd4d-dce5-4ac8-a7dd-e14585efdc41", + "value": "522210" + }, + { + "description": "Sales Financing ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d6870dc5-4eec-4938-bdcc-96c99029a8f1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "152b25df-9952-4a15-8a2a-6aa4f2871d61", + "value": "52222" + }, + { + "description": "Sales Financing ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "152b25df-9952-4a15-8a2a-6aa4f2871d61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d6870dc5-4eec-4938-bdcc-96c99029a8f1", + "value": "522220" + }, + { + "description": "Other Nondepository Credit Intermediation ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c3523ac2-e330-4972-98a8-0e44ed30186e", + "value": "52229" + }, + { + "description": "Consumer Lending ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f58ed61d-8e72-47b7-98b5-c52190c956e6", + "value": "522291" + }, + { + "description": "Real Estate Credit ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "216cb5ed-bff8-42f7-8cf3-e8c4baaef27a", + "value": "522292" + }, + { + "description": "International, Secondary Market, and All Other Nondepository Credit Intermediation ", + "related": [ + { + "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7b06da94-6b38-4d94-9217-388c34d5896f", + "value": "522299" + }, + { + "description": "Activities Related to Credit Intermediation ", + "related": [ + { + "dest-uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ac092056-118a-43c0-a46a-38761d290a9c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7f845ce9-0fcf-4e8e-b0a3-d58509dca401", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "89976176-1f5a-42ec-b6f7-96d0c16b131d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4e8d14c9-cead-4bef-b77f-dbff08736013", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6c6bc6e5-8135-4e6c-98e7-1feb869b696a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4cf85f92-3b2e-4fd5-8f57-5b38d0e9f16f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "value": "5223" + }, + { + "description": "Mortgage and Nonmortgage Loan Brokers ", + "related": [ + { + "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7f845ce9-0fcf-4e8e-b0a3-d58509dca401", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ac092056-118a-43c0-a46a-38761d290a9c", + "value": "52231" + }, + { + "description": "Mortgage and Nonmortgage Loan Brokers ", + "related": [ + { + "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ac092056-118a-43c0-a46a-38761d290a9c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7f845ce9-0fcf-4e8e-b0a3-d58509dca401", + "value": "522310" + }, + { + "description": "Financial Transactions Processing, Reserve, and Clearinghouse Activities ", + "related": [ + { + "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4e8d14c9-cead-4bef-b77f-dbff08736013", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "89976176-1f5a-42ec-b6f7-96d0c16b131d", + "value": "52232" + }, + { + "description": "Financial Transactions Processing, Reserve, and Clearinghouse Activities ", + "related": [ + { + "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "89976176-1f5a-42ec-b6f7-96d0c16b131d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4e8d14c9-cead-4bef-b77f-dbff08736013", + "value": "522320" + }, + { + "description": "Other Activities Related to Credit Intermediation ", + "related": [ + { + "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4cf85f92-3b2e-4fd5-8f57-5b38d0e9f16f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6c6bc6e5-8135-4e6c-98e7-1feb869b696a", + "value": "52239" + }, + { + "description": "Other Activities Related to Credit Intermediation ", + "related": [ + { + "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6c6bc6e5-8135-4e6c-98e7-1feb869b696a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4cf85f92-3b2e-4fd5-8f57-5b38d0e9f16f", + "value": "522390" + }, + { + "description": "Securities, Commodity Contracts, and Other Financial Investments and Related Activities", + "related": [ + { + "dest-uuid": "5b5670b9-0302-4d25-b1a0-a813e8a2e07d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6da97333-db84-4c08-bc1c-a05c8bbeb6d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ec7a05b3-466e-4db1-906d-1bbe7bc04371", + "value": "523" + }, + { + "description": "Securities and Commodity Contracts Intermediation and Brokerage", + "related": [ + { + "dest-uuid": "ec7a05b3-466e-4db1-906d-1bbe7bc04371", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ad33c729-8fa1-43b5-81ef-4d3b27888931", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9bf08826-c0d5-4d8d-bda0-9cbe2617ba07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3ae5918b-0fe4-4ad2-80f6-b1340dab2ec1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "146acf75-da47-4290-b6fd-ee8c2475a7b5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", + "value": "5231" + }, + { + "description": "Investment Banking and Securities Intermediation ", + "related": [ + { + "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9bf08826-c0d5-4d8d-bda0-9cbe2617ba07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ad33c729-8fa1-43b5-81ef-4d3b27888931", + "value": "52315" + }, + { + "description": "Investment Banking and Securities Intermediation ", + "related": [ + { + "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ad33c729-8fa1-43b5-81ef-4d3b27888931", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9bf08826-c0d5-4d8d-bda0-9cbe2617ba07", + "value": "523150" + }, + { + "description": "Commodity Contracts Intermediation ", + "related": [ + { + "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "146acf75-da47-4290-b6fd-ee8c2475a7b5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3ae5918b-0fe4-4ad2-80f6-b1340dab2ec1", + "value": "52316" + }, + { + "description": "Commodity Contracts Intermediation ", + "related": [ + { + "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3ae5918b-0fe4-4ad2-80f6-b1340dab2ec1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "146acf75-da47-4290-b6fd-ee8c2475a7b5", + "value": "523160" + }, + { + "description": "Securities and Commodity Exchanges", + "related": [ + { + "dest-uuid": "ec7a05b3-466e-4db1-906d-1bbe7bc04371", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b9b2683c-f667-4405-a6cf-8cf3be1c2d1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "949d35e0-ba38-4fc5-a9c2-a57ddbb017b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6da97333-db84-4c08-bc1c-a05c8bbeb6d1", + "value": "5232" + }, + { + "description": "Securities and Commodity Exchanges", + "related": [ + { + "dest-uuid": "6da97333-db84-4c08-bc1c-a05c8bbeb6d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "949d35e0-ba38-4fc5-a9c2-a57ddbb017b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b9b2683c-f667-4405-a6cf-8cf3be1c2d1c", + "value": "52321" + }, + { + "description": "Securities and Commodity Exchanges", + "related": [ + { + "dest-uuid": "6da97333-db84-4c08-bc1c-a05c8bbeb6d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b9b2683c-f667-4405-a6cf-8cf3be1c2d1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "949d35e0-ba38-4fc5-a9c2-a57ddbb017b2", + "value": "523210" + }, + { + "description": "Other Financial Investment Activities", + "related": [ + { + "dest-uuid": "ec7a05b3-466e-4db1-906d-1bbe7bc04371", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6ff6f684-ceb2-4d10-9ffb-9b34a8876055", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0eda9dbd-67a9-46ce-97d0-5da21a5e80a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fe85283f-c6d6-4af9-be7e-37af63162089", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5f503651-75b7-4a74-85af-5289b2f3e441", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d1f010a3-5d19-4b1a-9177-cc8954a5e55c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e3011497-bcf8-412e-8079-a9927afd44e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "96367168-5457-4a74-a5fa-e7b608b719b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "value": "5239" + }, + { + "description": "Miscellaneous Intermediation ", + "related": [ + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0eda9dbd-67a9-46ce-97d0-5da21a5e80a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6ff6f684-ceb2-4d10-9ffb-9b34a8876055", + "value": "52391" + }, + { + "description": "Miscellaneous Intermediation ", + "related": [ + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6ff6f684-ceb2-4d10-9ffb-9b34a8876055", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0eda9dbd-67a9-46ce-97d0-5da21a5e80a0", + "value": "523910" + }, + { + "description": "Portfolio Management and Investment Advice ", + "related": [ + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5f503651-75b7-4a74-85af-5289b2f3e441", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fe85283f-c6d6-4af9-be7e-37af63162089", + "value": "52394" + }, + { + "description": "Portfolio Management and Investment Advice ", + "related": [ + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fe85283f-c6d6-4af9-be7e-37af63162089", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5f503651-75b7-4a74-85af-5289b2f3e441", + "value": "523940" + }, + { + "description": "All Other Financial Investment Activities ", + "related": [ + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d1f010a3-5d19-4b1a-9177-cc8954a5e55c", + "value": "52399" + }, + { + "description": "Trust, Fiduciary, and Custody Activities ", + "related": [ + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e3011497-bcf8-412e-8079-a9927afd44e5", + "value": "523991" + }, + { + "description": "Miscellaneous Financial Investment Activities ", + "related": [ + { + "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "96367168-5457-4a74-a5fa-e7b608b719b3", + "value": "523999" + }, + { + "description": "Insurance Carriers and Related Activities", + "related": [ + { + "dest-uuid": "5b5670b9-0302-4d25-b1a0-a813e8a2e07d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "fdd18e97-66ac-4db4-a511-4ab4e56361ab", + "value": "524" + }, + { + "description": "Insurance Carriers", + "related": [ + { + "dest-uuid": "fdd18e97-66ac-4db4-a511-4ab4e56361ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "582e2608-22ca-429a-bf6a-460db770cf96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cf026d58-bbbc-4b67-affb-d764f1161e99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c5734f53-53b5-4abb-8ca9-2b9357fbe790", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bb840655-ac7d-4bf1-a130-75bc3e03b9f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "223679ab-b698-4d71-b09c-2d7223d9b375", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cfc49c55-4767-4f8f-b188-e5db14c75585", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "afc02e15-39a2-4d89-8426-90005f2d8d4e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "39dd35cf-c7c7-453b-8091-06d345fa2fa9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c2f54ffa-c215-4009-a2e0-6585deb23380", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "value": "5241" + }, + { + "description": "Direct Life, Health, and Medical Insurance Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "582e2608-22ca-429a-bf6a-460db770cf96", + "value": "52411" + }, + { + "description": "Direct Life Insurance Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cf026d58-bbbc-4b67-affb-d764f1161e99", + "value": "524113" + }, + { + "description": "Direct Health and Medical Insurance Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c5734f53-53b5-4abb-8ca9-2b9357fbe790", + "value": "524114" + }, + { + "description": "Direct Insurance (except Life, Health, and Medical) Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bb840655-ac7d-4bf1-a130-75bc3e03b9f8", + "value": "52412" + }, + { + "description": "Direct Property and Casualty Insurance Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "223679ab-b698-4d71-b09c-2d7223d9b375", + "value": "524126" + }, + { + "description": "Direct Title Insurance Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cfc49c55-4767-4f8f-b188-e5db14c75585", + "value": "524127" + }, + { + "description": "Other Direct Insurance (except Life, Health, and Medical) Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "afc02e15-39a2-4d89-8426-90005f2d8d4e", + "value": "524128" + }, + { + "description": "Reinsurance Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c2f54ffa-c215-4009-a2e0-6585deb23380", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "39dd35cf-c7c7-453b-8091-06d345fa2fa9", + "value": "52413" + }, + { + "description": "Reinsurance Carriers ", + "related": [ + { + "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "39dd35cf-c7c7-453b-8091-06d345fa2fa9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c2f54ffa-c215-4009-a2e0-6585deb23380", + "value": "524130" + }, + { + "description": "Agencies, Brokerages, and Other Insurance Related Activities", + "related": [ + { + "dest-uuid": "fdd18e97-66ac-4db4-a511-4ab4e56361ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4047adab-993e-4838-b9be-e21c16939173", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "07ffca00-3977-4640-81bb-de419d323213", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "304ec251-b000-481d-b95d-3c9af9f963ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d2ef54f3-f84c-4528-98fb-15da4d1de339", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9a801232-2175-4354-903a-bf127d27c421", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c7b1db90-45e3-4baf-b136-be202e6d6e19", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "value": "5242" + }, + { + "description": "Insurance Agencies and Brokerages ", + "related": [ + { + "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "07ffca00-3977-4640-81bb-de419d323213", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4047adab-993e-4838-b9be-e21c16939173", + "value": "52421" + }, + { + "description": "Insurance Agencies and Brokerages ", + "related": [ + { + "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4047adab-993e-4838-b9be-e21c16939173", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "07ffca00-3977-4640-81bb-de419d323213", + "value": "524210" + }, + { + "description": "Other Insurance Related Activities ", + "related": [ + { + "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "304ec251-b000-481d-b95d-3c9af9f963ef", + "value": "52429" + }, + { + "description": "Claims Adjusting ", + "related": [ + { + "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d2ef54f3-f84c-4528-98fb-15da4d1de339", + "value": "524291" + }, + { + "description": "Pharmacy Benefit Management and Other Third Party Administration of Insurance and Pension Funds ", + "related": [ + { + "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9a801232-2175-4354-903a-bf127d27c421", + "value": "524292" + }, + { + "description": "All Other Insurance Related Activities ", + "related": [ + { + "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c7b1db90-45e3-4baf-b136-be202e6d6e19", + "value": "524298" + }, + { + "description": "Funds, Trusts, and Other Financial Vehicles ", + "related": [ + { + "dest-uuid": "5b5670b9-0302-4d25-b1a0-a813e8a2e07d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8769d32f-a13e-413c-b6fb-ad79ac758ec8", + "value": "525" + }, + { + "description": "Insurance and Employee Benefit Funds ", + "related": [ + { + "dest-uuid": "8769d32f-a13e-413c-b6fb-ad79ac758ec8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7ef0d6c7-1010-4809-a5b0-818630722ff4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7bf9bf7a-5313-46b0-ac4f-3a991b684060", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f9e4b709-6502-401e-9fad-d85e1adee356", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "958f0912-7575-4178-9243-cc9c5526d1af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ee74799d-bb7e-4939-8c95-862bdd02ba89", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "32450137-4338-4c72-be74-3528a3bce2ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "value": "5251" + }, + { + "description": "Pension Funds ", + "related": [ + { + "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7bf9bf7a-5313-46b0-ac4f-3a991b684060", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7ef0d6c7-1010-4809-a5b0-818630722ff4", + "value": "52511" + }, + { + "description": "Pension Funds ", + "related": [ + { + "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7ef0d6c7-1010-4809-a5b0-818630722ff4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7bf9bf7a-5313-46b0-ac4f-3a991b684060", + "value": "525110" + }, + { + "description": "Health and Welfare Funds ", + "related": [ + { + "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "958f0912-7575-4178-9243-cc9c5526d1af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f9e4b709-6502-401e-9fad-d85e1adee356", + "value": "52512" + }, + { + "description": "Health and Welfare Funds ", + "related": [ + { + "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f9e4b709-6502-401e-9fad-d85e1adee356", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "958f0912-7575-4178-9243-cc9c5526d1af", + "value": "525120" + }, + { + "description": "Other Insurance Funds ", + "related": [ + { + "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "32450137-4338-4c72-be74-3528a3bce2ec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ee74799d-bb7e-4939-8c95-862bdd02ba89", + "value": "52519" + }, + { + "description": "Other Insurance Funds ", + "related": [ + { + "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ee74799d-bb7e-4939-8c95-862bdd02ba89", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "32450137-4338-4c72-be74-3528a3bce2ec", + "value": "525190" + }, + { + "description": "Other Investment Pools and Funds", + "related": [ + { + "dest-uuid": "8769d32f-a13e-413c-b6fb-ad79ac758ec8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8d4218ad-5094-4db8-9525-75b12b25691a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ecfd1a64-e888-42fe-9d58-714e2e34936c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c52c1d0-ab88-4189-9b8b-defa0e238891", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "46c2c781-c986-4fbb-958a-a5ee8b810f5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8dc5474a-066a-47b6-84bc-a3acce0fcbcb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "44f4c8fb-32d5-4b6c-aa24-6775e4f7f072", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "value": "5259" + }, + { + "description": "Open-End Investment Funds ", + "related": [ + { + "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ecfd1a64-e888-42fe-9d58-714e2e34936c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8d4218ad-5094-4db8-9525-75b12b25691a", + "value": "52591" + }, + { + "description": "Open-End Investment Funds ", + "related": [ + { + "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8d4218ad-5094-4db8-9525-75b12b25691a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ecfd1a64-e888-42fe-9d58-714e2e34936c", + "value": "525910" + }, + { + "description": "Trusts, Estates, and Agency Accounts ", + "related": [ + { + "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "46c2c781-c986-4fbb-958a-a5ee8b810f5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c52c1d0-ab88-4189-9b8b-defa0e238891", + "value": "52592" + }, + { + "description": "Trusts, Estates, and Agency Accounts ", + "related": [ + { + "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c52c1d0-ab88-4189-9b8b-defa0e238891", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "46c2c781-c986-4fbb-958a-a5ee8b810f5a", + "value": "525920" + }, + { + "description": "Other Financial Vehicles ", + "related": [ + { + "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "44f4c8fb-32d5-4b6c-aa24-6775e4f7f072", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8dc5474a-066a-47b6-84bc-a3acce0fcbcb", + "value": "52599" + }, + { + "description": "Other Financial Vehicles ", + "related": [ + { + "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8dc5474a-066a-47b6-84bc-a3acce0fcbcb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "44f4c8fb-32d5-4b6c-aa24-6775e4f7f072", + "value": "525990" + }, + { + "description": "Real Estate and Rental and Leasing", + "related": [ + { + "dest-uuid": "9e52d6e8-fc0f-42c3-a404-57278f0b15c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c198929c-5d7a-4c54-9824-9fd565d8f49b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c4db5755-ae83-4543-8f2e-8ead35873a8b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3f073746-cbc2-41ab-b1be-4cb54b800043", + "value": "53" + }, + { + "description": "Real Estate", + "related": [ + { + "dest-uuid": "3f073746-cbc2-41ab-b1be-4cb54b800043", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b9ba3d1a-472e-4a41-b3e6-3833a33cc520", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9e52d6e8-fc0f-42c3-a404-57278f0b15c3", + "value": "531" + }, + { + "description": "Lessors of Real Estate", + "related": [ + { + "dest-uuid": "9e52d6e8-fc0f-42c3-a404-57278f0b15c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd7bca1f-83fa-4853-b54d-7fdd52572407", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "28dd8c00-1631-4b18-bfe5-870dd696a6d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5066ec7f-8491-4da3-beca-6c23ac7e1c2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "11a145a9-3331-4f75-9dbd-bef5eb85350e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "43b06879-a37a-42b2-bde6-51a2c279df7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2d91ca03-00b2-4106-863a-4946759db184", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cf0bffe3-e91b-4fca-8d55-e3ef91624a07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7c331b96-70e8-4202-af11-2d35c8623bb2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "value": "5311" + }, + { + "description": "Lessors of Residential Buildings and Dwellings ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "28dd8c00-1631-4b18-bfe5-870dd696a6d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fd7bca1f-83fa-4853-b54d-7fdd52572407", + "value": "53111" + }, + { + "description": "Lessors of Residential Buildings and Dwellings ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd7bca1f-83fa-4853-b54d-7fdd52572407", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "28dd8c00-1631-4b18-bfe5-870dd696a6d5", + "value": "531110" + }, + { + "description": "Lessors of Nonresidential Buildings (except Miniwarehouses) ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "11a145a9-3331-4f75-9dbd-bef5eb85350e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5066ec7f-8491-4da3-beca-6c23ac7e1c2b", + "value": "53112" + }, + { + "description": "Lessors of Nonresidential Buildings (except Miniwarehouses) ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5066ec7f-8491-4da3-beca-6c23ac7e1c2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "11a145a9-3331-4f75-9dbd-bef5eb85350e", + "value": "531120" + }, + { + "description": "Lessors of Miniwarehouses and Self-Storage Units ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2d91ca03-00b2-4106-863a-4946759db184", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "43b06879-a37a-42b2-bde6-51a2c279df7b", + "value": "53113" + }, + { + "description": "Lessors of Miniwarehouses and Self-Storage Units ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "43b06879-a37a-42b2-bde6-51a2c279df7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2d91ca03-00b2-4106-863a-4946759db184", + "value": "531130" + }, + { + "description": "Lessors of Other Real Estate Property ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7c331b96-70e8-4202-af11-2d35c8623bb2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cf0bffe3-e91b-4fca-8d55-e3ef91624a07", + "value": "53119" + }, + { + "description": "Lessors of Other Real Estate Property ", + "related": [ + { + "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cf0bffe3-e91b-4fca-8d55-e3ef91624a07", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7c331b96-70e8-4202-af11-2d35c8623bb2", + "value": "531190" + }, + { + "description": "Offices of Real Estate Agents and Brokers", + "related": [ + { + "dest-uuid": "9e52d6e8-fc0f-42c3-a404-57278f0b15c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e556771e-3a18-4aa4-b049-389062071bb1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "79c08083-cd12-4930-9af5-b83647325fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b9ba3d1a-472e-4a41-b3e6-3833a33cc520", + "value": "5312" + }, + { + "description": "Offices of Real Estate Agents and Brokers", + "related": [ + { + "dest-uuid": "b9ba3d1a-472e-4a41-b3e6-3833a33cc520", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "79c08083-cd12-4930-9af5-b83647325fde", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e556771e-3a18-4aa4-b049-389062071bb1", + "value": "53121" + }, + { + "description": "Offices of Real Estate Agents and Brokers", + "related": [ + { + "dest-uuid": "b9ba3d1a-472e-4a41-b3e6-3833a33cc520", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e556771e-3a18-4aa4-b049-389062071bb1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "79c08083-cd12-4930-9af5-b83647325fde", + "value": "531210" + }, + { + "description": "Activities Related to Real Estate", + "related": [ + { + "dest-uuid": "9e52d6e8-fc0f-42c3-a404-57278f0b15c3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dcda7abc-f492-44b7-a965-64424b9f9592", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a607e4fb-7d8d-403b-9b64-97b39ad5c01d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4d29bad1-1ea5-4a15-b9af-935931f6dd16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "46d64878-1c9d-4790-99ed-04b2ddf3c0ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "55ef9e5a-7536-409d-8dd8-80d3eb878339", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "699d0390-06bf-4f59-b666-451a9b86d367", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8716ecae-8b28-4e63-822d-cbfcdc5b8a85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "value": "5313" + }, + { + "description": "Real Estate Property Managers ", + "related": [ + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dcda7abc-f492-44b7-a965-64424b9f9592", + "value": "53131" + }, + { + "description": "Residential Property Managers ", + "related": [ + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a607e4fb-7d8d-403b-9b64-97b39ad5c01d", + "value": "531311" + }, + { + "description": "Nonresidential Property Managers ", + "related": [ + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4d29bad1-1ea5-4a15-b9af-935931f6dd16", + "value": "531312" + }, + { + "description": "Offices of Real Estate Appraisers ", + "related": [ + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "55ef9e5a-7536-409d-8dd8-80d3eb878339", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "46d64878-1c9d-4790-99ed-04b2ddf3c0ff", + "value": "53132" + }, + { + "description": "Offices of Real Estate Appraisers ", + "related": [ + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "46d64878-1c9d-4790-99ed-04b2ddf3c0ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "55ef9e5a-7536-409d-8dd8-80d3eb878339", + "value": "531320" + }, + { + "description": "Other Activities Related to Real Estate ", + "related": [ + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8716ecae-8b28-4e63-822d-cbfcdc5b8a85", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "699d0390-06bf-4f59-b666-451a9b86d367", + "value": "53139" + }, + { + "description": "Other Activities Related to Real Estate ", + "related": [ + { + "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "699d0390-06bf-4f59-b666-451a9b86d367", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8716ecae-8b28-4e63-822d-cbfcdc5b8a85", + "value": "531390" + }, + { + "description": "Rental and Leasing Services", + "related": [ + { + "dest-uuid": "3f073746-cbc2-41ab-b1be-4cb54b800043", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9493bc4d-14d8-4a15-a290-99f2ec77e2f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c198929c-5d7a-4c54-9824-9fd565d8f49b", + "value": "532" + }, + { + "description": "Automotive Equipment Rental and Leasing", + "related": [ + { + "dest-uuid": "c198929c-5d7a-4c54-9824-9fd565d8f49b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d630e080-8322-4395-b2b9-82b09c7e465a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dda7392a-e955-46f6-bfa2-87cabc24e78d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6cf9e223-f17d-4069-bf00-3997cd2734bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "22c63efc-f299-4cc7-89da-369786aa59f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eff88b52-f895-4979-9aa4-ff120e4af190", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", + "value": "5321" + }, + { + "description": "Passenger Car Rental and Leasing", + "related": [ + { + "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d630e080-8322-4395-b2b9-82b09c7e465a", + "value": "53211" + }, + { + "description": "Passenger Car Rental ", + "related": [ + { + "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dda7392a-e955-46f6-bfa2-87cabc24e78d", + "value": "532111" + }, + { + "description": "Passenger Car Leasing ", + "related": [ + { + "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6cf9e223-f17d-4069-bf00-3997cd2734bb", + "value": "532112" + }, + { + "description": "Truck, Utility Trailer, and RV (Recreational Vehicle) Rental and Leasing", + "related": [ + { + "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eff88b52-f895-4979-9aa4-ff120e4af190", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "22c63efc-f299-4cc7-89da-369786aa59f5", + "value": "53212" + }, + { + "description": "Truck, Utility Trailer, and RV (Recreational Vehicle) Rental and Leasing ", + "related": [ + { + "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "22c63efc-f299-4cc7-89da-369786aa59f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eff88b52-f895-4979-9aa4-ff120e4af190", + "value": "532120" + }, + { + "description": "Consumer Goods Rental", + "related": [ + { + "dest-uuid": "c198929c-5d7a-4c54-9824-9fd565d8f49b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f7347517-c960-4a92-acb6-ca3408c470db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "03849cf9-c469-4c56-a578-b150dbd1492a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "776e937a-d829-4a6d-b527-2d5950cf3ba9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bdca61ba-445a-4e2e-a2c3-444852f9ad3f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d1479b4a-a040-46c7-8b1f-a7f84a375122", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9c1820f2-b879-4fe0-8cd6-3ea13413a0d2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9fc7a224-7eb5-4a50-a200-777e47be7c41", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f55f5f21-39fd-4b7f-8dcc-dc22178d56be", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "value": "5322" + }, + { + "description": "Consumer Electronics and Appliances Rental", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "03849cf9-c469-4c56-a578-b150dbd1492a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f7347517-c960-4a92-acb6-ca3408c470db", + "value": "53221" + }, + { + "description": "Consumer Electronics and Appliances Rental", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f7347517-c960-4a92-acb6-ca3408c470db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "03849cf9-c469-4c56-a578-b150dbd1492a", + "value": "532210" + }, + { + "description": "Other Consumer Goods Rental ", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "776e937a-d829-4a6d-b527-2d5950cf3ba9", + "value": "53228" + }, + { + "description": "Formal Wear and Costume Rental", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bdca61ba-445a-4e2e-a2c3-444852f9ad3f", + "value": "532281" + }, + { + "description": "Video Tape and Disc Rental", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d1479b4a-a040-46c7-8b1f-a7f84a375122", + "value": "532282" + }, + { + "description": "Home Health Equipment Rental ", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9c1820f2-b879-4fe0-8cd6-3ea13413a0d2", + "value": "532283" + }, + { + "description": "Recreational Goods Rental ", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9fc7a224-7eb5-4a50-a200-777e47be7c41", + "value": "532284" + }, + { + "description": "All Other Consumer Goods Rental ", + "related": [ + { + "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f55f5f21-39fd-4b7f-8dcc-dc22178d56be", + "value": "532289" + }, + { + "description": "General Rental Centers", + "related": [ + { + "dest-uuid": "c198929c-5d7a-4c54-9824-9fd565d8f49b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4f5af2dc-13cc-4aff-91df-01e2f0ffea10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fd33aa94-8c08-4ba3-9d92-7391ede27f00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9493bc4d-14d8-4a15-a290-99f2ec77e2f5", + "value": "5323" + }, + { + "description": "General Rental Centers", + "related": [ + { + "dest-uuid": "9493bc4d-14d8-4a15-a290-99f2ec77e2f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd33aa94-8c08-4ba3-9d92-7391ede27f00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4f5af2dc-13cc-4aff-91df-01e2f0ffea10", + "value": "53231" + }, + { + "description": "General Rental Centers", + "related": [ + { + "dest-uuid": "9493bc4d-14d8-4a15-a290-99f2ec77e2f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4f5af2dc-13cc-4aff-91df-01e2f0ffea10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fd33aa94-8c08-4ba3-9d92-7391ede27f00", + "value": "532310" + }, + { + "description": "Commercial and Industrial Machinery and Equipment Rental and Leasing", + "related": [ + { + "dest-uuid": "c198929c-5d7a-4c54-9824-9fd565d8f49b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "48c5b88f-0a33-4e12-b5a2-d1b110829e70", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dfd8394a-0749-4a49-914a-20028334a53d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "30963a01-6825-465d-ae65-a667921b0154", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b1174dc6-70b8-451b-abf4-f0b3da382737", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5cf4c9af-7d6e-4340-82e6-441a184453f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f18a02f4-2da1-448d-ac9c-cfa670051609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4d448404-20b5-4fcb-8a27-5e01abb7ce2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "value": "5324" + }, + { + "description": "Construction, Transportation, Mining, and Forestry Machinery and Equipment Rental and Leasing", + "related": [ + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "48c5b88f-0a33-4e12-b5a2-d1b110829e70", + "value": "53241" + }, + { + "description": "Commercial Air, Rail, and Water Transportation Equipment Rental and Leasing ", + "related": [ + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dfd8394a-0749-4a49-914a-20028334a53d", + "value": "532411" + }, + { + "description": "Construction, Mining, and Forestry Machinery and Equipment Rental and Leasing ", + "related": [ + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "30963a01-6825-465d-ae65-a667921b0154", + "value": "532412" + }, + { + "description": "Office Machinery and Equipment Rental and Leasing", + "related": [ + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5cf4c9af-7d6e-4340-82e6-441a184453f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b1174dc6-70b8-451b-abf4-f0b3da382737", + "value": "53242" + }, + { + "description": "Office Machinery and Equipment Rental and Leasing", + "related": [ + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b1174dc6-70b8-451b-abf4-f0b3da382737", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5cf4c9af-7d6e-4340-82e6-441a184453f5", + "value": "532420" + }, + { + "description": "Other Commercial and Industrial Machinery and Equipment Rental and Leasing", + "related": [ + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4d448404-20b5-4fcb-8a27-5e01abb7ce2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f18a02f4-2da1-448d-ac9c-cfa670051609", + "value": "53249" + }, + { + "description": "Other Commercial and Industrial Machinery and Equipment Rental and Leasing ", + "related": [ + { + "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f18a02f4-2da1-448d-ac9c-cfa670051609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4d448404-20b5-4fcb-8a27-5e01abb7ce2b", + "value": "532490" + }, + { + "description": "Lessors of Nonfinancial Intangible Assets (except Copyrighted Works)", + "related": [ + { + "dest-uuid": "3f073746-cbc2-41ab-b1be-4cb54b800043", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a77b77b6-7491-4581-8c94-8151adf2dedb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c4db5755-ae83-4543-8f2e-8ead35873a8b", + "value": "533" + }, + { + "description": "Lessors of Nonfinancial Intangible Assets (except Copyrighted Works)", + "related": [ + { + "dest-uuid": "c4db5755-ae83-4543-8f2e-8ead35873a8b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dcf4170d-00cc-45b6-b7a0-6b49dbd9790e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "11d09edd-1f7a-4554-9527-c6bc2ba8f772", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a77b77b6-7491-4581-8c94-8151adf2dedb", + "value": "5331" + }, + { + "description": "Lessors of Nonfinancial Intangible Assets (except Copyrighted Works)", + "related": [ + { + "dest-uuid": "a77b77b6-7491-4581-8c94-8151adf2dedb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "11d09edd-1f7a-4554-9527-c6bc2ba8f772", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dcf4170d-00cc-45b6-b7a0-6b49dbd9790e", + "value": "53311" + }, + { + "description": "Lessors of Nonfinancial Intangible Assets (except Copyrighted Works)", + "related": [ + { + "dest-uuid": "a77b77b6-7491-4581-8c94-8151adf2dedb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dcf4170d-00cc-45b6-b7a0-6b49dbd9790e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "11d09edd-1f7a-4554-9527-c6bc2ba8f772", + "value": "533110" + }, + { + "description": "Professional, Scientific, and Technical Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a492137b-b2ff-426d-a66c-e848ce181916", + "value": "54" + }, + { + "description": "Professional, Scientific, and Technical Services", + "related": [ + { + "dest-uuid": "a492137b-b2ff-426d-a66c-e848ce181916", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "value": "541" + }, + { + "description": "Legal Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3f1a2663-46ea-47bf-981a-e60058b57251", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1e7db932-e56f-4daf-9873-a077e6557cf3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a13059b8-e744-451b-bb75-b449761d607b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "42fd414f-b58a-4ee3-8123-05baef6dcb04", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "807bd441-ea68-419f-b635-1f5c83596cdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "89d0181c-f6cb-4f7e-86e3-4c5dc240fc45", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "898b5113-ba23-47aa-b8b8-9bac06a05ae8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "value": "5411" + }, + { + "description": "Offices of Lawyers", + "related": [ + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1e7db932-e56f-4daf-9873-a077e6557cf3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3f1a2663-46ea-47bf-981a-e60058b57251", + "value": "54111" + }, + { + "description": "Offices of Lawyers", + "related": [ + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3f1a2663-46ea-47bf-981a-e60058b57251", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1e7db932-e56f-4daf-9873-a077e6557cf3", + "value": "541110" + }, + { + "description": "Offices of Notaries", + "related": [ + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "42fd414f-b58a-4ee3-8123-05baef6dcb04", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a13059b8-e744-451b-bb75-b449761d607b", + "value": "54112" + }, + { + "description": "Offices of Notaries", + "related": [ + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a13059b8-e744-451b-bb75-b449761d607b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "42fd414f-b58a-4ee3-8123-05baef6dcb04", + "value": "541120" + }, + { + "description": "Other Legal Services", + "related": [ + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "807bd441-ea68-419f-b635-1f5c83596cdf", + "value": "54119" + }, + { + "description": "Title Abstract and Settlement Offices ", + "related": [ + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "89d0181c-f6cb-4f7e-86e3-4c5dc240fc45", + "value": "541191" + }, + { + "description": "All Other Legal Services ", + "related": [ + { + "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "898b5113-ba23-47aa-b8b8-9bac06a05ae8", + "value": "541199" + }, + { + "description": "Accounting, Tax Preparation, Bookkeeping, and Payroll Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddc7778c-7146-42b0-bed8-064ac73f8193", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1e0be210-e5fc-408a-a796-90081121d92c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "44b67efd-6e6d-4116-986f-7662f9a7c6e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c7a4db22-896f-4cbd-99bb-6c75c7416f69", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "21af0dde-3af5-4e57-a2a1-bb6f732cd008", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", + "value": "5412" + }, + { + "description": "Accounting, Tax Preparation, Bookkeeping, and Payroll Services", + "related": [ + { + "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ddc7778c-7146-42b0-bed8-064ac73f8193", + "value": "54121" + }, + { + "description": "Offices of Certified Public Accountants ", + "related": [ + { + "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1e0be210-e5fc-408a-a796-90081121d92c", + "value": "541211" + }, + { + "description": "Tax Preparation Services ", + "related": [ + { + "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "44b67efd-6e6d-4116-986f-7662f9a7c6e9", + "value": "541213" + }, + { + "description": "Payroll Services ", + "related": [ + { + "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c7a4db22-896f-4cbd-99bb-6c75c7416f69", + "value": "541214" + }, + { + "description": "Other Accounting Services ", + "related": [ + { + "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "21af0dde-3af5-4e57-a2a1-bb6f732cd008", + "value": "541219" + }, + { + "description": "Architectural, Engineering, and Related Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3136648d-6897-4074-b62d-0a8aacba1d7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "147cf1f3-da2f-49a0-bef6-9d955f31628b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1b415911-9485-4833-b264-13d6c0bd4c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5ed72ce2-1c67-4266-9dde-c25ae65f0ab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c55345e9-b41c-4d4b-ab35-65812bd841a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f3ae0da3-3fe6-4dc9-8495-ca3400aaa0e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2ae1a12f-fcda-4c79-a369-4962048c992a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8c591e30-d293-44be-afa2-fee299b5a33f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6fbd6cbe-c9aa-4f2c-9a25-edc58dbe2471", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d0c69f77-b4ed-4077-8c8d-595d3e852212", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ef4e7e3a-4f12-44d0-b947-9339a1c94c7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "72c2f2d7-541a-4f85-b50b-21e9126590f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b99bd26a-0254-4ccc-8ff6-5bbfbbf68619", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1c36302e-7851-478b-aee4-2e85b41a45cd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9c445357-f9ea-493d-975f-eee1efe51bbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5a6984e8-70a7-4786-ba7f-03bf458c4ba4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "value": "5413" + }, + { + "description": "Architectural Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "147cf1f3-da2f-49a0-bef6-9d955f31628b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3136648d-6897-4074-b62d-0a8aacba1d7c", + "value": "54131" + }, + { + "description": "Architectural Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3136648d-6897-4074-b62d-0a8aacba1d7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "147cf1f3-da2f-49a0-bef6-9d955f31628b", + "value": "541310" + }, + { + "description": "Landscape Architectural Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5ed72ce2-1c67-4266-9dde-c25ae65f0ab8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1b415911-9485-4833-b264-13d6c0bd4c7f", + "value": "54132" + }, + { + "description": "Landscape Architectural Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1b415911-9485-4833-b264-13d6c0bd4c7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5ed72ce2-1c67-4266-9dde-c25ae65f0ab8", + "value": "541320" + }, + { + "description": "Engineering Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f3ae0da3-3fe6-4dc9-8495-ca3400aaa0e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c55345e9-b41c-4d4b-ab35-65812bd841a1", + "value": "54133" + }, + { + "description": "Engineering Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c55345e9-b41c-4d4b-ab35-65812bd841a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f3ae0da3-3fe6-4dc9-8495-ca3400aaa0e1", + "value": "541330" + }, + { + "description": "Drafting Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8c591e30-d293-44be-afa2-fee299b5a33f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2ae1a12f-fcda-4c79-a369-4962048c992a", + "value": "54134" + }, + { + "description": "Drafting Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2ae1a12f-fcda-4c79-a369-4962048c992a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8c591e30-d293-44be-afa2-fee299b5a33f", + "value": "541340" + }, + { + "description": "Building Inspection Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d0c69f77-b4ed-4077-8c8d-595d3e852212", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6fbd6cbe-c9aa-4f2c-9a25-edc58dbe2471", + "value": "54135" + }, + { + "description": "Building Inspection Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6fbd6cbe-c9aa-4f2c-9a25-edc58dbe2471", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d0c69f77-b4ed-4077-8c8d-595d3e852212", + "value": "541350" + }, + { + "description": "Geophysical Surveying and Mapping Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "72c2f2d7-541a-4f85-b50b-21e9126590f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ef4e7e3a-4f12-44d0-b947-9339a1c94c7b", + "value": "54136" + }, + { + "description": "Geophysical Surveying and Mapping Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ef4e7e3a-4f12-44d0-b947-9339a1c94c7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "72c2f2d7-541a-4f85-b50b-21e9126590f5", + "value": "541360" + }, + { + "description": "Surveying and Mapping (except Geophysical) Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1c36302e-7851-478b-aee4-2e85b41a45cd", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b99bd26a-0254-4ccc-8ff6-5bbfbbf68619", + "value": "54137" + }, + { + "description": "Surveying and Mapping (except Geophysical) Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b99bd26a-0254-4ccc-8ff6-5bbfbbf68619", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1c36302e-7851-478b-aee4-2e85b41a45cd", + "value": "541370" + }, + { + "description": "Testing Laboratories and Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5a6984e8-70a7-4786-ba7f-03bf458c4ba4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9c445357-f9ea-493d-975f-eee1efe51bbb", + "value": "54138" + }, + { + "description": "Testing Laboratories and Services", + "related": [ + { + "dest-uuid": "7e42c5aa-4071-4137-8faa-57c5226be98d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9c445357-f9ea-493d-975f-eee1efe51bbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5a6984e8-70a7-4786-ba7f-03bf458c4ba4", + "value": "541380" + }, + { + "description": "Specialized Design Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d73945de-22e7-4ac6-b930-d2c36d512210", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a642f3cf-71c3-4c23-87fe-8362f6cb41f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2d951eb1-740d-4f84-a4d9-b6b5c41dd191", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ddf9c7cc-4c57-40cf-88ec-004b2212d73c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "279d1589-127b-470d-a2c4-b80380309fa0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c0cd552b-06e1-4b87-8b0d-71951e4e1d10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6c2c7f2c-ca0b-4622-8bc9-c8dca41d25e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b2fb04dc-5bab-4317-a1a7-938fc8596af8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "value": "5414" + }, + { + "description": "Interior Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a642f3cf-71c3-4c23-87fe-8362f6cb41f2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d73945de-22e7-4ac6-b930-d2c36d512210", + "value": "54141" + }, + { + "description": "Interior Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d73945de-22e7-4ac6-b930-d2c36d512210", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a642f3cf-71c3-4c23-87fe-8362f6cb41f2", + "value": "541410" + }, + { + "description": "Industrial Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddf9c7cc-4c57-40cf-88ec-004b2212d73c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2d951eb1-740d-4f84-a4d9-b6b5c41dd191", + "value": "54142" + }, + { + "description": "Industrial Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2d951eb1-740d-4f84-a4d9-b6b5c41dd191", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ddf9c7cc-4c57-40cf-88ec-004b2212d73c", + "value": "541420" + }, + { + "description": "Graphic Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c0cd552b-06e1-4b87-8b0d-71951e4e1d10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "279d1589-127b-470d-a2c4-b80380309fa0", + "value": "54143" + }, + { + "description": "Graphic Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "279d1589-127b-470d-a2c4-b80380309fa0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c0cd552b-06e1-4b87-8b0d-71951e4e1d10", + "value": "541430" + }, + { + "description": "Other Specialized Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b2fb04dc-5bab-4317-a1a7-938fc8596af8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6c2c7f2c-ca0b-4622-8bc9-c8dca41d25e9", + "value": "54149" + }, + { + "description": "Other Specialized Design Services", + "related": [ + { + "dest-uuid": "24fa52b4-34ed-43e2-85e7-25f2c7d61abc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6c2c7f2c-ca0b-4622-8bc9-c8dca41d25e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b2fb04dc-5bab-4317-a1a7-938fc8596af8", + "value": "541490" + }, + { + "description": "Computer Systems Design and Related Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8444a01f-c66b-4f28-9ae8-cc5c2d4ee667", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8ba799b1-a1c7-402f-9ccd-f9045a44862c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "461168ce-3ebe-4c3c-9a3c-f63a5b23b073", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cd967a08-d1e9-4825-a7b3-4ccffb6a1ef0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f774b2b5-23ea-4d96-a53c-a7c0f00c7265", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", + "value": "5415" + }, + { + "description": "Computer Systems Design and Related Services", + "related": [ + { + "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8444a01f-c66b-4f28-9ae8-cc5c2d4ee667", + "value": "54151" + }, + { + "description": "Custom Computer Programming Services ", + "related": [ + { + "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8ba799b1-a1c7-402f-9ccd-f9045a44862c", + "value": "541511" + }, + { + "description": "Computer Systems Design Services ", + "related": [ + { + "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "461168ce-3ebe-4c3c-9a3c-f63a5b23b073", + "value": "541512" + }, + { + "description": "Computer Facilities Management Services ", + "related": [ + { + "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cd967a08-d1e9-4825-a7b3-4ccffb6a1ef0", + "value": "541513" + }, + { + "description": "Other Computer Related Services", + "related": [ + { + "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f774b2b5-23ea-4d96-a53c-a7c0f00c7265", + "value": "541519" + }, + { + "description": "Management, Scientific, and Technical Consulting Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bbfb339f-6c8c-40f2-9e56-f9f09c5389d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d69ee8d9-d060-48c6-8ca3-e4f050c03041", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "10d444b9-796b-4637-acc4-0769836f052f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d5c09b51-cf63-4084-a434-117200af8516", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5cea3ebc-ef72-42f2-8ae5-c3814d8995ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "13910e60-a4f6-4496-a2f2-826b67f1e03d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7962a435-0bfd-4e26-95f6-d307653966e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "149ba44c-37a1-4e4a-b0ba-c2438a8cdb08", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "177799fc-8da5-4af6-9b9f-e6d034cd3ea0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eaa922ea-06c6-4834-84fe-ef8a842d4bc9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "value": "5416" + }, + { + "description": "Management Consulting Services", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bbfb339f-6c8c-40f2-9e56-f9f09c5389d8", + "value": "54161" + }, + { + "description": "Administrative Management and General Management Consulting Services ", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d69ee8d9-d060-48c6-8ca3-e4f050c03041", + "value": "541611" + }, + { + "description": "Human Resources Consulting Services ", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "10d444b9-796b-4637-acc4-0769836f052f", + "value": "541612" + }, + { + "description": "Marketing Consulting Services ", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d5c09b51-cf63-4084-a434-117200af8516", + "value": "541613" + }, + { + "description": "Process, Physical Distribution, and Logistics Consulting Services ", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5cea3ebc-ef72-42f2-8ae5-c3814d8995ac", + "value": "541614" + }, + { + "description": "Other Management Consulting Services ", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "13910e60-a4f6-4496-a2f2-826b67f1e03d", + "value": "541618" + }, + { + "description": "Environmental Consulting Services", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "149ba44c-37a1-4e4a-b0ba-c2438a8cdb08", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7962a435-0bfd-4e26-95f6-d307653966e6", + "value": "54162" + }, + { + "description": "Environmental Consulting Services", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7962a435-0bfd-4e26-95f6-d307653966e6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "149ba44c-37a1-4e4a-b0ba-c2438a8cdb08", + "value": "541620" + }, + { + "description": "Other Scientific and Technical Consulting Services", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eaa922ea-06c6-4834-84fe-ef8a842d4bc9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "177799fc-8da5-4af6-9b9f-e6d034cd3ea0", + "value": "54169" + }, + { + "description": "Other Scientific and Technical Consulting Services", + "related": [ + { + "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "177799fc-8da5-4af6-9b9f-e6d034cd3ea0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eaa922ea-06c6-4834-84fe-ef8a842d4bc9", + "value": "541690" + }, + { + "description": "Scientific Research and Development Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "332951e4-7022-45e4-af1e-4c0eb94b86ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "70f4468b-92e4-4991-b360-ccb31e21f9ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "28ea18cc-cfbd-41af-8b65-85779e6ab9ce", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6347e972-d6bc-4bbe-8404-32cd4edb4d78", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2b7325ca-b1f2-4d0f-9ca4-0b86f182f05d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0f7a204e-74bf-40cd-b0f7-560f9ec8a171", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "value": "5417" + }, + { + "description": "Research and Development in the Physical, Engineering, and Life Sciences", + "related": [ + { + "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "332951e4-7022-45e4-af1e-4c0eb94b86ac", + "value": "54171" + }, + { + "description": "Research and Development in Nanotechnology ", + "related": [ + { + "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "70f4468b-92e4-4991-b360-ccb31e21f9ac", + "value": "541713" + }, + { + "description": "Research and Development in Biotechnology (except Nanobiotechnology)", + "related": [ + { + "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "28ea18cc-cfbd-41af-8b65-85779e6ab9ce", + "value": "541714" + }, + { + "description": "Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology) ", + "related": [ + { + "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6347e972-d6bc-4bbe-8404-32cd4edb4d78", + "value": "541715" + }, + { + "description": "Research and Development in the Social Sciences and Humanities", + "related": [ + { + "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0f7a204e-74bf-40cd-b0f7-560f9ec8a171", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2b7325ca-b1f2-4d0f-9ca4-0b86f182f05d", + "value": "54172" + }, + { + "description": "Research and Development in the Social Sciences and Humanities ", + "related": [ + { + "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2b7325ca-b1f2-4d0f-9ca4-0b86f182f05d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0f7a204e-74bf-40cd-b0f7-560f9ec8a171", + "value": "541720" + }, + { + "description": "Advertising, Public Relations, and Related Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "03cfcedc-cd58-428f-b57b-c8f48bf05d12", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b332200f-2199-4794-b069-7b3b30172187", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2c709300-b7a6-4709-b694-39c9d783a9da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e74b15a1-c878-4822-a777-0ea39df0669c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e8b7d67c-a316-461e-a9fa-b322cbe624c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "73370573-a9df-44e3-828a-6223bb1b8a79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "030965c8-17f8-4fcc-b7a5-82fda4dd8750", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8f4e2f50-57c6-4def-a6a3-a5f9f28a2206", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cfcd5ab0-d82a-421b-9931-15c971e011bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f7325b57-534e-45cb-a9a6-3655d8cc398f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4a9d518e-8b8f-4f47-a9e5-f66c25b2840e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eec861ab-f630-4f6a-bf93-c51d6f4b4473", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e1dfa87f-18e2-498b-b802-f83cea06cb47", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5e57d417-d89c-4673-82b4-d189d940c782", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2a6a2a55-7778-4f53-9bf6-02a42bed920d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e4c79ddc-760c-451f-a6c6-50f57fd1e901", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "value": "5418" + }, + { + "description": "Advertising Agencies", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b332200f-2199-4794-b069-7b3b30172187", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "03cfcedc-cd58-428f-b57b-c8f48bf05d12", + "value": "54181" + }, + { + "description": "Advertising Agencies", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "03cfcedc-cd58-428f-b57b-c8f48bf05d12", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b332200f-2199-4794-b069-7b3b30172187", + "value": "541810" + }, + { + "description": "Public Relations Agencies", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e74b15a1-c878-4822-a777-0ea39df0669c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2c709300-b7a6-4709-b694-39c9d783a9da", + "value": "54182" + }, + { + "description": "Public Relations Agencies", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2c709300-b7a6-4709-b694-39c9d783a9da", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e74b15a1-c878-4822-a777-0ea39df0669c", + "value": "541820" + }, + { + "description": "Media Buying Agencies", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "73370573-a9df-44e3-828a-6223bb1b8a79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e8b7d67c-a316-461e-a9fa-b322cbe624c7", + "value": "54183" + }, + { + "description": "Media Buying Agencies", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e8b7d67c-a316-461e-a9fa-b322cbe624c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "73370573-a9df-44e3-828a-6223bb1b8a79", + "value": "541830" + }, + { + "description": "Media Representatives", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8f4e2f50-57c6-4def-a6a3-a5f9f28a2206", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "030965c8-17f8-4fcc-b7a5-82fda4dd8750", + "value": "54184" + }, + { + "description": "Media Representatives", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "030965c8-17f8-4fcc-b7a5-82fda4dd8750", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8f4e2f50-57c6-4def-a6a3-a5f9f28a2206", + "value": "541840" + }, + { + "description": "Indoor and Outdoor Display Advertising", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f7325b57-534e-45cb-a9a6-3655d8cc398f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cfcd5ab0-d82a-421b-9931-15c971e011bf", + "value": "54185" + }, + { + "description": "Indoor and Outdoor Display Advertising", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cfcd5ab0-d82a-421b-9931-15c971e011bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f7325b57-534e-45cb-a9a6-3655d8cc398f", + "value": "541850" + }, + { + "description": "Direct Mail Advertising", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eec861ab-f630-4f6a-bf93-c51d6f4b4473", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4a9d518e-8b8f-4f47-a9e5-f66c25b2840e", + "value": "54186" + }, + { + "description": "Direct Mail Advertising", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4a9d518e-8b8f-4f47-a9e5-f66c25b2840e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eec861ab-f630-4f6a-bf93-c51d6f4b4473", + "value": "541860" + }, + { + "description": "Advertising Material Distribution Services", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5e57d417-d89c-4673-82b4-d189d940c782", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e1dfa87f-18e2-498b-b802-f83cea06cb47", + "value": "54187" + }, + { + "description": "Advertising Material Distribution Services", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e1dfa87f-18e2-498b-b802-f83cea06cb47", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5e57d417-d89c-4673-82b4-d189d940c782", + "value": "541870" + }, + { + "description": "Other Services Related to Advertising", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e4c79ddc-760c-451f-a6c6-50f57fd1e901", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2a6a2a55-7778-4f53-9bf6-02a42bed920d", + "value": "54189" + }, + { + "description": "Other Services Related to Advertising ", + "related": [ + { + "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2a6a2a55-7778-4f53-9bf6-02a42bed920d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e4c79ddc-760c-451f-a6c6-50f57fd1e901", + "value": "541890" + }, + { + "description": "Other Professional, Scientific, and Technical Services", + "related": [ + { + "dest-uuid": "5e0b7040-566c-4d9a-ab31-0a3e32f516d9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "084c4a11-c779-40dd-92f2-f05796377f18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2f14a5bc-9fb0-4598-8328-eaa5e84b9a2f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aac3736b-bd07-4062-b5ce-d1340e918978", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "14f8b277-e992-4cf9-bc01-386a32be2c82", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bc860b6c-27cb-45ef-80ba-d2540ff9bc06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e273eaf8-be79-4418-85c2-25adbb613d4e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "abc72267-02c0-4e49-a7b0-f9a1572f609b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4258f851-aab7-4f67-a117-3f9f2b387fa8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "45f51fb2-4957-456a-8e60-24c377bf7bc0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a5bb83a-0834-4610-a094-5304363638d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fff72629-d032-4228-8205-880d9689f2a4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "value": "5419" + }, + { + "description": "Marketing Research and Public Opinion Polling", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2f14a5bc-9fb0-4598-8328-eaa5e84b9a2f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "084c4a11-c779-40dd-92f2-f05796377f18", + "value": "54191" + }, + { + "description": "Marketing Research and Public Opinion Polling", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "084c4a11-c779-40dd-92f2-f05796377f18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2f14a5bc-9fb0-4598-8328-eaa5e84b9a2f", + "value": "541910" + }, + { + "description": "Photographic Services", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "aac3736b-bd07-4062-b5ce-d1340e918978", + "value": "54192" + }, + { + "description": "Photography Studios, Portrait ", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "14f8b277-e992-4cf9-bc01-386a32be2c82", + "value": "541921" + }, + { + "description": "Commercial Photography ", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bc860b6c-27cb-45ef-80ba-d2540ff9bc06", + "value": "541922" + }, + { + "description": "Translation and Interpretation Services", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "abc72267-02c0-4e49-a7b0-f9a1572f609b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e273eaf8-be79-4418-85c2-25adbb613d4e", + "value": "54193" + }, + { + "description": "Translation and Interpretation Services", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e273eaf8-be79-4418-85c2-25adbb613d4e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "abc72267-02c0-4e49-a7b0-f9a1572f609b", + "value": "541930" + }, + { + "description": "Veterinary Services", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "45f51fb2-4957-456a-8e60-24c377bf7bc0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4258f851-aab7-4f67-a117-3f9f2b387fa8", + "value": "54194" + }, + { + "description": "Veterinary Services ", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4258f851-aab7-4f67-a117-3f9f2b387fa8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "45f51fb2-4957-456a-8e60-24c377bf7bc0", + "value": "541940" + }, + { + "description": "All Other Professional, Scientific, and Technical Services", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fff72629-d032-4228-8205-880d9689f2a4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8a5bb83a-0834-4610-a094-5304363638d5", + "value": "54199" + }, + { + "description": "All Other Professional, Scientific, and Technical Services", + "related": [ + { + "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8a5bb83a-0834-4610-a094-5304363638d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fff72629-d032-4228-8205-880d9689f2a4", + "value": "541990" + }, + { + "description": "Management of Companies and Enterprises", + "related": [ + { + "dest-uuid": "9d2a3ece-7238-46a9-bb85-3759325d2fbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3c1b5a07-68bf-49db-992d-e60f7e1adf39", + "value": "55" + }, + { + "description": "Management of Companies and Enterprises", + "related": [ + { + "dest-uuid": "3c1b5a07-68bf-49db-992d-e60f7e1adf39", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9d2a3ece-7238-46a9-bb85-3759325d2fbb", + "value": "551" + }, + { + "description": "Management of Companies and Enterprises", + "related": [ + { + "dest-uuid": "9d2a3ece-7238-46a9-bb85-3759325d2fbb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a12b5bff-7713-491a-977a-845abc6c5354", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "199e0006-8620-4962-b67d-0f4785f6884d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0e1bf3b2-8529-4b1e-96b1-f78bb68b54b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "512cdda6-6569-4206-b9cb-1dacbe153b0d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", + "value": "5511" + }, + { + "description": "Management of Companies and Enterprises", + "related": [ + { + "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a12b5bff-7713-491a-977a-845abc6c5354", + "value": "55111" + }, + { + "description": "Offices of Bank Holding Companies ", + "related": [ + { + "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "199e0006-8620-4962-b67d-0f4785f6884d", + "value": "551111" + }, + { + "description": "Offices of Other Holding Companies ", + "related": [ + { + "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0e1bf3b2-8529-4b1e-96b1-f78bb68b54b7", + "value": "551112" + }, + { + "description": "Corporate, Subsidiary, and Regional Managing Offices ", + "related": [ + { + "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "512cdda6-6569-4206-b9cb-1dacbe153b0d", + "value": "551114" + }, + { + "description": "Administrative and Support and Waste Management and Remediation Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9bee3166-4144-4fd7-84ad-0efc086dc71f", + "value": "56" + }, + { + "description": "Administrative and Support Services", + "related": [ + { + "dest-uuid": "9bee3166-4144-4fd7-84ad-0efc086dc71f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "42421c60-2054-43f4-9593-987ac60e4e81", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "00c8f938-f88d-4db5-ac09-e6540957d519", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "value": "561" + }, + { + "description": "Office Administrative Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5b2f1765-351a-4409-aa15-e78fca6e8b61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7b856367-7f6c-4481-a48d-eb587e75f922", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "42421c60-2054-43f4-9593-987ac60e4e81", + "value": "5611" + }, + { + "description": "Office Administrative Services", + "related": [ + { + "dest-uuid": "42421c60-2054-43f4-9593-987ac60e4e81", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7b856367-7f6c-4481-a48d-eb587e75f922", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5b2f1765-351a-4409-aa15-e78fca6e8b61", + "value": "56111" + }, + { + "description": "Office Administrative Services", + "related": [ + { + "dest-uuid": "42421c60-2054-43f4-9593-987ac60e4e81", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5b2f1765-351a-4409-aa15-e78fca6e8b61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7b856367-7f6c-4481-a48d-eb587e75f922", + "value": "561110" + }, + { + "description": "Facilities Support Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e280b62f-38ec-499c-a5f4-f86c84664f6a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "70898321-db77-4828-bbfa-bef4c7234818", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "00c8f938-f88d-4db5-ac09-e6540957d519", + "value": "5612" + }, + { + "description": "Facilities Support Services", + "related": [ + { + "dest-uuid": "00c8f938-f88d-4db5-ac09-e6540957d519", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "70898321-db77-4828-bbfa-bef4c7234818", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e280b62f-38ec-499c-a5f4-f86c84664f6a", + "value": "56121" + }, + { + "description": "Facilities Support Services", + "related": [ + { + "dest-uuid": "00c8f938-f88d-4db5-ac09-e6540957d519", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e280b62f-38ec-499c-a5f4-f86c84664f6a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "70898321-db77-4828-bbfa-bef4c7234818", + "value": "561210" + }, + { + "description": "Employment Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8bab226-332d-45f7-b039-e81bf51015b8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a7aa6d0e-7ec8-4cd1-be6d-4790d17c44ac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c6a950e4-d860-47c3-80d0-db9e66d10339", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ccf1cd4d-74f7-41f4-81e3-3e8e61b90f7e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8bb51ccf-6fa1-4945-9bbb-03c0872fedab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ff0a338b-b3d1-4afa-9e1d-efaca3361204", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "28ddc2d6-5702-4dd3-857b-6519e66b0673", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "value": "5613" + }, + { + "description": "Employment Placement Agencies and Executive Search Services", + "related": [ + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c8bab226-332d-45f7-b039-e81bf51015b8", + "value": "56131" + }, + { + "description": "Employment Placement Agencies ", + "related": [ + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a7aa6d0e-7ec8-4cd1-be6d-4790d17c44ac", + "value": "561311" + }, + { + "description": "Executive Search Services ", + "related": [ + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c6a950e4-d860-47c3-80d0-db9e66d10339", + "value": "561312" + }, + { + "description": "Temporary Help Services", + "related": [ + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8bb51ccf-6fa1-4945-9bbb-03c0872fedab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ccf1cd4d-74f7-41f4-81e3-3e8e61b90f7e", + "value": "56132" + }, + { + "description": "Temporary Help Services", + "related": [ + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ccf1cd4d-74f7-41f4-81e3-3e8e61b90f7e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8bb51ccf-6fa1-4945-9bbb-03c0872fedab", + "value": "561320" + }, + { + "description": "Professional Employer Organizations", + "related": [ + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "28ddc2d6-5702-4dd3-857b-6519e66b0673", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ff0a338b-b3d1-4afa-9e1d-efaca3361204", + "value": "56133" + }, + { + "description": "Professional Employer Organizations", + "related": [ + { + "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ff0a338b-b3d1-4afa-9e1d-efaca3361204", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "28ddc2d6-5702-4dd3-857b-6519e66b0673", + "value": "561330" + }, + { + "description": "Business Support Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8b76d782-d625-46b5-8dda-b2aa171e8351", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a4fc6f88-d0ff-42e3-9755-cf0fa4ff7e4d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dd54b9ec-b7a7-41dc-a10d-c07c30715aa8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "25b953b0-f9c3-485b-8fd9-5c6c8572cee2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6dffe283-dcf1-49a9-941b-8aad87f0cc7b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cf2a48a3-f05d-4e68-8914-9197d532385f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ba5a1c66-d8c6-455e-9c57-c904fc726fc7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "808474c7-bcb7-479c-8660-3f45aa666bff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8ecd590f-7fb9-4602-9f96-3e842001d06e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e8122f2c-9999-4b1b-a459-9ee0ca8b9765", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a6640bbd-37b9-40d5-baed-c80975f037d2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f6e20dfc-6b85-483d-9a85-3d1213165565", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "42f28c53-fc17-4aa8-b145-c003c5b6d89c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3e3deb0e-9a30-4f42-8183-ead90f702de8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "348cafb9-13d4-409b-ace3-b65d528f3b73", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7c6118e9-714d-40db-834f-69918895017d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "value": "5614" + }, + { + "description": "Document Preparation Services", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a4fc6f88-d0ff-42e3-9755-cf0fa4ff7e4d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8b76d782-d625-46b5-8dda-b2aa171e8351", + "value": "56141" + }, + { + "description": "Document Preparation Services", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8b76d782-d625-46b5-8dda-b2aa171e8351", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a4fc6f88-d0ff-42e3-9755-cf0fa4ff7e4d", + "value": "561410" + }, + { + "description": "Telephone Call Centers", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dd54b9ec-b7a7-41dc-a10d-c07c30715aa8", + "value": "56142" + }, + { + "description": "Telephone Answering Services ", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "25b953b0-f9c3-485b-8fd9-5c6c8572cee2", + "value": "561421" + }, + { + "description": "Telemarketing Bureaus and Other Contact Centers ", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6dffe283-dcf1-49a9-941b-8aad87f0cc7b", + "value": "561422" + }, + { + "description": "Business Service Centers", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cf2a48a3-f05d-4e68-8914-9197d532385f", + "value": "56143" + }, + { + "description": "Private Mail Centers ", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ba5a1c66-d8c6-455e-9c57-c904fc726fc7", + "value": "561431" + }, + { + "description": "Other Business Service Centers (including Copy Shops) ", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "808474c7-bcb7-479c-8660-3f45aa666bff", + "value": "561439" + }, + { + "description": "Collection Agencies", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e8122f2c-9999-4b1b-a459-9ee0ca8b9765", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8ecd590f-7fb9-4602-9f96-3e842001d06e", + "value": "56144" + }, + { + "description": "Collection Agencies", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8ecd590f-7fb9-4602-9f96-3e842001d06e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e8122f2c-9999-4b1b-a459-9ee0ca8b9765", + "value": "561440" + }, + { + "description": "Credit Bureaus", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f6e20dfc-6b85-483d-9a85-3d1213165565", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a6640bbd-37b9-40d5-baed-c80975f037d2", + "value": "56145" + }, + { + "description": "Credit Bureaus", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a6640bbd-37b9-40d5-baed-c80975f037d2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f6e20dfc-6b85-483d-9a85-3d1213165565", + "value": "561450" + }, + { + "description": "Other Business Support Services", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "42f28c53-fc17-4aa8-b145-c003c5b6d89c", + "value": "56149" + }, + { + "description": "Repossession Services ", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3e3deb0e-9a30-4f42-8183-ead90f702de8", + "value": "561491" + }, + { + "description": "Court Reporting and Stenotype Services ", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "348cafb9-13d4-409b-ace3-b65d528f3b73", + "value": "561492" + }, + { + "description": "All Other Business Support Services ", + "related": [ + { + "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7c6118e9-714d-40db-834f-69918895017d", + "value": "561499" + }, + { + "description": "Travel Arrangement and Reservation Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3196e76f-eb3c-4e1a-9fcd-81fdc1beff96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3836ebfe-7e28-4d9c-ac06-94c14107d457", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fa19943f-1c5a-40e7-8018-0e74f9c4591b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f73bc990-8aa1-4b60-a73f-be81698310a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "391bcd41-87cd-404b-ad74-44f6737ed725", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f9b6b69e-955a-423a-9da1-9b88aabdff24", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "47d7eb30-df87-40ec-b217-1cdb70ca254a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "value": "5615" + }, + { + "description": "Travel Agencies", + "related": [ + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3836ebfe-7e28-4d9c-ac06-94c14107d457", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3196e76f-eb3c-4e1a-9fcd-81fdc1beff96", + "value": "56151" + }, + { + "description": "Travel Agencies", + "related": [ + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3196e76f-eb3c-4e1a-9fcd-81fdc1beff96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3836ebfe-7e28-4d9c-ac06-94c14107d457", + "value": "561510" + }, + { + "description": "Tour Operators", + "related": [ + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f73bc990-8aa1-4b60-a73f-be81698310a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fa19943f-1c5a-40e7-8018-0e74f9c4591b", + "value": "56152" + }, + { + "description": "Tour Operators", + "related": [ + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fa19943f-1c5a-40e7-8018-0e74f9c4591b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f73bc990-8aa1-4b60-a73f-be81698310a0", + "value": "561520" + }, + { + "description": "Other Travel Arrangement and Reservation Services", + "related": [ + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "391bcd41-87cd-404b-ad74-44f6737ed725", + "value": "56159" + }, + { + "description": "Convention and Visitors Bureaus ", + "related": [ + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f9b6b69e-955a-423a-9da1-9b88aabdff24", + "value": "561591" + }, + { + "description": "All Other Travel Arrangement and Reservation Services ", + "related": [ + { + "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "47d7eb30-df87-40ec-b217-1cdb70ca254a", + "value": "561599" + }, + { + "description": "Investigation and Security Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0b506d1f-3e2b-444d-a496-7c1d41cb7a16", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4af36bfc-5000-46b9-abff-c36da130428c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "001a9239-1f71-4132-b895-01dc027ba0d6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c53f243e-441f-4fc7-9608-52bd7379bd19", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6f84baa9-6ddf-4651-80e5-2a52c033e4b5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e1783cd9-9be0-464a-97b0-d1e70f4ffc2c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "deb06c2e-08fe-4fdc-8f57-908c11cd5099", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "value": "5616" + }, + { + "description": "Investigation, Guard, and Armored Car Services", + "related": [ + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "0b506d1f-3e2b-444d-a496-7c1d41cb7a16", + "value": "56161" + }, + { + "description": "Investigation and Personal Background Check Services ", + "related": [ + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4af36bfc-5000-46b9-abff-c36da130428c", + "value": "561611" + }, + { + "description": "Security Guards and Patrol Services ", + "related": [ + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "001a9239-1f71-4132-b895-01dc027ba0d6", + "value": "561612" + }, + { + "description": "Armored Car Services ", + "related": [ + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c53f243e-441f-4fc7-9608-52bd7379bd19", + "value": "561613" + }, + { + "description": "Security Systems Services", + "related": [ + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6f84baa9-6ddf-4651-80e5-2a52c033e4b5", + "value": "56162" + }, + { + "description": "Security Systems Services (except Locksmiths) ", + "related": [ + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e1783cd9-9be0-464a-97b0-d1e70f4ffc2c", + "value": "561621" + }, + { + "description": "Locksmiths ", + "related": [ + { + "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "deb06c2e-08fe-4fdc-8f57-908c11cd5099", + "value": "561622" + }, + { + "description": "Services to Buildings and Dwellings", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a13939e4-fbb2-49c8-aa60-edde371899c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6aa38014-986a-410e-892d-b24324007d43", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bde99e8f-2777-40bc-85c0-1e08b7b7f7a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "72db5505-197c-4248-bf47-37fb7e6b7d56", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "71a7302a-f49b-4763-a8da-8f630593d9a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6989fa04-d1a0-4bca-89df-2ee4e08cb877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f35dc687-e360-4f8e-b8cf-11753ae97453", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "687feb93-740a-4e71-9e65-36063e441a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "36d1cd63-f1ff-4d0c-99ba-b9dd1cde5444", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "06a62f22-ad5c-446e-87b0-4709f2e8d241", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "value": "5617" + }, + { + "description": "Exterminating and Pest Control Services", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6aa38014-986a-410e-892d-b24324007d43", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a13939e4-fbb2-49c8-aa60-edde371899c7", + "value": "56171" + }, + { + "description": "Exterminating and Pest Control Services", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a13939e4-fbb2-49c8-aa60-edde371899c7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6aa38014-986a-410e-892d-b24324007d43", + "value": "561710" + }, + { + "description": "Janitorial Services", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "72db5505-197c-4248-bf47-37fb7e6b7d56", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bde99e8f-2777-40bc-85c0-1e08b7b7f7a7", + "value": "56172" + }, + { + "description": "Janitorial Services ", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bde99e8f-2777-40bc-85c0-1e08b7b7f7a7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "72db5505-197c-4248-bf47-37fb7e6b7d56", + "value": "561720" + }, + { + "description": "Landscaping Services", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6989fa04-d1a0-4bca-89df-2ee4e08cb877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "71a7302a-f49b-4763-a8da-8f630593d9a3", + "value": "56173" + }, + { + "description": "Landscaping Services", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "71a7302a-f49b-4763-a8da-8f630593d9a3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6989fa04-d1a0-4bca-89df-2ee4e08cb877", + "value": "561730" + }, + { + "description": "Carpet and Upholstery Cleaning Services", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "687feb93-740a-4e71-9e65-36063e441a29", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f35dc687-e360-4f8e-b8cf-11753ae97453", + "value": "56174" + }, + { + "description": "Carpet and Upholstery Cleaning Services", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f35dc687-e360-4f8e-b8cf-11753ae97453", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "687feb93-740a-4e71-9e65-36063e441a29", + "value": "561740" + }, + { + "description": "Other Services to Buildings and Dwellings", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "06a62f22-ad5c-446e-87b0-4709f2e8d241", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "36d1cd63-f1ff-4d0c-99ba-b9dd1cde5444", + "value": "56179" + }, + { + "description": "Other Services to Buildings and Dwellings ", + "related": [ + { + "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "36d1cd63-f1ff-4d0c-99ba-b9dd1cde5444", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "06a62f22-ad5c-446e-87b0-4709f2e8d241", + "value": "561790" + }, + { + "description": "Other Support Services", + "related": [ + { + "dest-uuid": "a6240347-5042-462d-bc03-d6fc92175383", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "55b1f615-a5da-46ed-bf8c-a17b448f6e2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "27432c5f-76bc-46b1-b57c-1ab9018084f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0cfeea55-535f-4876-ae09-814696aeb9d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6b07e786-740f-4688-b8b3-d9d55c007737", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2130f927-38cc-4274-b233-a620c5449ddf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "296e4701-2424-414d-849a-01ce2e5ddbad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "value": "5619" + }, + { + "description": "Packaging and Labeling Services", + "related": [ + { + "dest-uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "27432c5f-76bc-46b1-b57c-1ab9018084f8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "55b1f615-a5da-46ed-bf8c-a17b448f6e2a", + "value": "56191" + }, + { + "description": "Packaging and Labeling Services", + "related": [ + { + "dest-uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "55b1f615-a5da-46ed-bf8c-a17b448f6e2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "27432c5f-76bc-46b1-b57c-1ab9018084f8", + "value": "561910" + }, + { + "description": "Convention and Trade Show Organizers", + "related": [ + { + "dest-uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6b07e786-740f-4688-b8b3-d9d55c007737", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0cfeea55-535f-4876-ae09-814696aeb9d3", + "value": "56192" + }, + { + "description": "Convention and Trade Show Organizers", + "related": [ + { + "dest-uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0cfeea55-535f-4876-ae09-814696aeb9d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6b07e786-740f-4688-b8b3-d9d55c007737", + "value": "561920" + }, + { + "description": "All Other Support Services", + "related": [ + { + "dest-uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "296e4701-2424-414d-849a-01ce2e5ddbad", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2130f927-38cc-4274-b233-a620c5449ddf", + "value": "56199" + }, + { + "description": "All Other Support Services", + "related": [ + { + "dest-uuid": "f629880e-ca1d-4be0-a268-e8ca2052e25c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2130f927-38cc-4274-b233-a620c5449ddf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "296e4701-2424-414d-849a-01ce2e5ddbad", + "value": "561990" + }, + { + "description": "Waste Management and Remediation Services", + "related": [ + { + "dest-uuid": "9bee3166-4144-4fd7-84ad-0efc086dc71f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", + "value": "562" + }, + { + "description": "Waste Collection ", + "related": [ + { + "dest-uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "af302210-26b9-4f42-8e82-82661af63cd3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9465e399-bc9e-477a-9b2a-57ac9c80f67e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7f92a4d2-ee45-4a73-bd73-f45e1811ca3c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "63242ec1-03d9-4bc5-bc8f-362585f6403e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", + "value": "5621" + }, + { + "description": "Waste Collection ", + "related": [ + { + "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "af302210-26b9-4f42-8e82-82661af63cd3", + "value": "56211" + }, + { + "description": "Solid Waste Collection ", + "related": [ + { + "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9465e399-bc9e-477a-9b2a-57ac9c80f67e", + "value": "562111" + }, + { + "description": "Hazardous Waste Collection ", + "related": [ + { + "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7f92a4d2-ee45-4a73-bd73-f45e1811ca3c", + "value": "562112" + }, + { + "description": "Other Waste Collection ", + "related": [ + { + "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "63242ec1-03d9-4bc5-bc8f-362585f6403e", + "value": "562119" + }, + { + "description": "Waste Treatment and Disposal ", + "related": [ + { + "dest-uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7a809d39-7e08-4ba9-9f61-55d4b7efc703", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3aef0eea-2e6d-49ef-9966-40458bde6d53", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a4c335d3-7eab-4c3f-a0c2-7c91da4e2fe9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c73e1329-0c34-45f0-8d56-d645ad4e7270", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "455623c0-d38e-4a91-8c7e-cc1db7f62382", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", + "value": "5622" + }, + { + "description": "Waste Treatment and Disposal ", + "related": [ + { + "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7a809d39-7e08-4ba9-9f61-55d4b7efc703", + "value": "56221" + }, + { + "description": "Hazardous Waste Treatment and Disposal ", + "related": [ + { + "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3aef0eea-2e6d-49ef-9966-40458bde6d53", + "value": "562211" + }, + { + "description": "Solid Waste Landfill ", + "related": [ + { + "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a4c335d3-7eab-4c3f-a0c2-7c91da4e2fe9", + "value": "562212" + }, + { + "description": "Solid Waste Combustors and Incinerators ", + "related": [ + { + "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c73e1329-0c34-45f0-8d56-d645ad4e7270", + "value": "562213" + }, + { + "description": "Other Nonhazardous Waste Treatment and Disposal ", + "related": [ + { + "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "455623c0-d38e-4a91-8c7e-cc1db7f62382", + "value": "562219" + }, + { + "description": "Remediation and Other Waste Management Services ", + "related": [ + { + "dest-uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "47425b7c-09d4-46f6-b7b8-b069296f4a06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e42dd272-64d0-439f-bd71-52498cc1124a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "582d76a1-db06-4434-b360-2ffca9e931de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "54d741b2-282f-4787-8c1c-fb293e5a3306", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3396c9cb-b2bb-4102-8b18-80d4ea799e34", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4bb703cb-9774-482f-85e7-abc4769df877", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dbf1582b-fd0e-41fc-be8c-43d6b431fb97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "value": "5629" + }, + { + "description": "Remediation Services ", + "related": [ + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e42dd272-64d0-439f-bd71-52498cc1124a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "47425b7c-09d4-46f6-b7b8-b069296f4a06", + "value": "56291" + }, + { + "description": "Remediation Services ", + "related": [ + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "47425b7c-09d4-46f6-b7b8-b069296f4a06", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e42dd272-64d0-439f-bd71-52498cc1124a", + "value": "562910" + }, + { + "description": "Materials Recovery Facilities ", + "related": [ + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "54d741b2-282f-4787-8c1c-fb293e5a3306", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "582d76a1-db06-4434-b360-2ffca9e931de", + "value": "56292" + }, + { + "description": "Materials Recovery Facilities ", + "related": [ + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "582d76a1-db06-4434-b360-2ffca9e931de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "54d741b2-282f-4787-8c1c-fb293e5a3306", + "value": "562920" + }, + { + "description": "All Other Waste Management Services ", + "related": [ + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3396c9cb-b2bb-4102-8b18-80d4ea799e34", + "value": "56299" + }, + { + "description": "Septic Tank and Related Services ", + "related": [ + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4bb703cb-9774-482f-85e7-abc4769df877", + "value": "562991" + }, + { + "description": "All Other Miscellaneous Waste Management Services ", + "related": [ + { + "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dbf1582b-fd0e-41fc-be8c-43d6b431fb97", + "value": "562998" + }, + { + "description": "Educational Services", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9c45f66f-8c48-4ed1-b3fc-ba30721569d1", + "value": "61" + }, + { + "description": "Educational Services", + "related": [ + { + "dest-uuid": "9c45f66f-8c48-4ed1-b3fc-ba30721569d1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7db6382e-37c8-4ae9-a4b5-86b789435256", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "de0146fd-5a34-4e57-9b48-47293088011d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0b7fb81c-867a-46ad-a1df-38803247a5c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4dfc0a25-e078-4288-b287-a8800157ed99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "value": "611" + }, + { + "description": "Elementary and Secondary Schools", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d3d1b0fb-8404-4edb-8ac8-6a15c4e3109b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "407e0a6a-7535-4ae0-9386-490b79315f35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "7db6382e-37c8-4ae9-a4b5-86b789435256", + "value": "6111" + }, + { + "description": "Elementary and Secondary Schools ", + "related": [ + { + "dest-uuid": "7db6382e-37c8-4ae9-a4b5-86b789435256", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "407e0a6a-7535-4ae0-9386-490b79315f35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d3d1b0fb-8404-4edb-8ac8-6a15c4e3109b", + "value": "61111" + }, + { + "description": "Elementary and Secondary Schools ", + "related": [ + { + "dest-uuid": "7db6382e-37c8-4ae9-a4b5-86b789435256", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d3d1b0fb-8404-4edb-8ac8-6a15c4e3109b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "407e0a6a-7535-4ae0-9386-490b79315f35", + "value": "611110" + }, + { + "description": "Junior Colleges", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a8292e31-1b1d-4d03-8410-8558166a83c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "340eab27-8b64-410e-ba5e-a9284d0d9553", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "de0146fd-5a34-4e57-9b48-47293088011d", + "value": "6112" + }, + { + "description": "Junior Colleges", + "related": [ + { + "dest-uuid": "de0146fd-5a34-4e57-9b48-47293088011d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "340eab27-8b64-410e-ba5e-a9284d0d9553", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a8292e31-1b1d-4d03-8410-8558166a83c1", + "value": "61121" + }, + { + "description": "Junior Colleges ", + "related": [ + { + "dest-uuid": "de0146fd-5a34-4e57-9b48-47293088011d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a8292e31-1b1d-4d03-8410-8558166a83c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "340eab27-8b64-410e-ba5e-a9284d0d9553", + "value": "611210" + }, + { + "description": "Colleges, Universities, and Professional Schools", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6982eab4-ecc3-4ca2-8db5-1b5fe66a806f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b5ac4fd9-0dd2-4969-8df1-71a6d667afba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0b7fb81c-867a-46ad-a1df-38803247a5c6", + "value": "6113" + }, + { + "description": "Colleges, Universities, and Professional Schools", + "related": [ + { + "dest-uuid": "0b7fb81c-867a-46ad-a1df-38803247a5c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b5ac4fd9-0dd2-4969-8df1-71a6d667afba", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6982eab4-ecc3-4ca2-8db5-1b5fe66a806f", + "value": "61131" + }, + { + "description": "Colleges, Universities, and Professional Schools ", + "related": [ + { + "dest-uuid": "0b7fb81c-867a-46ad-a1df-38803247a5c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6982eab4-ecc3-4ca2-8db5-1b5fe66a806f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b5ac4fd9-0dd2-4969-8df1-71a6d667afba", + "value": "611310" + }, + { + "description": "Business Schools and Computer and Management Training", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7ac363f2-212d-4889-8d8a-113eaf3a64d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "163c532c-8b24-4e92-9b74-6110a0e2ec8b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c83d7f17-a00c-4413-858b-96f9f9334ae2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b57b2d33-8e06-4435-9690-d7bc3c7ea833", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1063f295-0630-4777-90f8-afba805b199a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2cde9de6-166c-4f29-9c9d-583eaf51ec00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "value": "6114" + }, + { + "description": "Business and Secretarial Schools", + "related": [ + { + "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "163c532c-8b24-4e92-9b74-6110a0e2ec8b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7ac363f2-212d-4889-8d8a-113eaf3a64d0", + "value": "61141" + }, + { + "description": "Business and Secretarial Schools ", + "related": [ + { + "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7ac363f2-212d-4889-8d8a-113eaf3a64d0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "163c532c-8b24-4e92-9b74-6110a0e2ec8b", + "value": "611410" + }, + { + "description": "Computer Training", + "related": [ + { + "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b57b2d33-8e06-4435-9690-d7bc3c7ea833", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c83d7f17-a00c-4413-858b-96f9f9334ae2", + "value": "61142" + }, + { + "description": "Computer Training ", + "related": [ + { + "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c83d7f17-a00c-4413-858b-96f9f9334ae2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b57b2d33-8e06-4435-9690-d7bc3c7ea833", + "value": "611420" + }, + { + "description": "Professional and Management Development Training", + "related": [ + { + "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2cde9de6-166c-4f29-9c9d-583eaf51ec00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1063f295-0630-4777-90f8-afba805b199a", + "value": "61143" + }, + { + "description": "Professional and Management Development Training ", + "related": [ + { + "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1063f295-0630-4777-90f8-afba805b199a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2cde9de6-166c-4f29-9c9d-583eaf51ec00", + "value": "611430" + }, + { + "description": "Technical and Trade Schools ", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3bf1ca42-32b0-4c7e-9716-3202f93e0255", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b6574051-d46f-4a42-8459-c7f045795163", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "724dd6cb-1fe3-42aa-934a-1b21c1e1f94d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3401f0a5-f797-483f-8c92-9fc4793666f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b43a3263-3017-443e-9388-e37dc7909b68", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", + "value": "6115" + }, + { + "description": "Technical and Trade Schools", + "related": [ + { + "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3bf1ca42-32b0-4c7e-9716-3202f93e0255", + "value": "61151" + }, + { + "description": "Cosmetology and Barber Schools ", + "related": [ + { + "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b6574051-d46f-4a42-8459-c7f045795163", + "value": "611511" + }, + { + "description": "Flight Training ", + "related": [ + { + "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "724dd6cb-1fe3-42aa-934a-1b21c1e1f94d", + "value": "611512" + }, + { + "description": "Apprenticeship Training ", + "related": [ + { + "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3401f0a5-f797-483f-8c92-9fc4793666f5", + "value": "611513" + }, + { + "description": "Other Technical and Trade Schools ", + "related": [ + { + "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b43a3263-3017-443e-9388-e37dc7909b68", + "value": "611519" + }, + { + "description": "Other Schools and Instruction", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4fd03c18-17fc-4b24-a2b0-0fbd4a32ae65", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4ae0118a-aa6a-43f0-88d4-030951980b7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "56ad7247-5b33-4423-946e-8a4cd48bf096", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ad5a9e67-b19c-4346-b986-90d36d7a8a15", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e4de90ac-1de4-4223-a121-b45c8edc0a11", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "90dacc45-3c93-47f3-b3a6-918e878360c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1057edf3-3d5e-41e3-9904-327d29582fff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "da64b7db-9f68-4ba3-81b4-6fb532bc4821", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a4098a26-a09f-456a-be14-65bafbddac8e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5b89efbf-6340-419e-8c16-4311519af45f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "value": "6116" + }, + { + "description": "Fine Arts Schools", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4ae0118a-aa6a-43f0-88d4-030951980b7f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4fd03c18-17fc-4b24-a2b0-0fbd4a32ae65", + "value": "61161" + }, + { + "description": "Fine Arts Schools ", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4fd03c18-17fc-4b24-a2b0-0fbd4a32ae65", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4ae0118a-aa6a-43f0-88d4-030951980b7f", + "value": "611610" + }, + { + "description": "Sports and Recreation Instruction", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ad5a9e67-b19c-4346-b986-90d36d7a8a15", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "56ad7247-5b33-4423-946e-8a4cd48bf096", + "value": "61162" + }, + { + "description": "Sports and Recreation Instruction ", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "56ad7247-5b33-4423-946e-8a4cd48bf096", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ad5a9e67-b19c-4346-b986-90d36d7a8a15", + "value": "611620" + }, + { + "description": "Language Schools", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90dacc45-3c93-47f3-b3a6-918e878360c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e4de90ac-1de4-4223-a121-b45c8edc0a11", + "value": "61163" + }, + { + "description": "Language Schools ", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e4de90ac-1de4-4223-a121-b45c8edc0a11", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "90dacc45-3c93-47f3-b3a6-918e878360c1", + "value": "611630" + }, + { + "description": "All Other Schools and Instruction", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1057edf3-3d5e-41e3-9904-327d29582fff", + "value": "61169" + }, + { + "description": "Exam Preparation and Tutoring ", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "da64b7db-9f68-4ba3-81b4-6fb532bc4821", + "value": "611691" + }, + { + "description": "Automobile Driving Schools ", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a4098a26-a09f-456a-be14-65bafbddac8e", + "value": "611692" + }, + { + "description": "All Other Miscellaneous Schools and Instruction ", + "related": [ + { + "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5b89efbf-6340-419e-8c16-4311519af45f", + "value": "611699" + }, + { + "description": "Educational Support Services", + "related": [ + { + "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6e528f4b-70e5-4049-a9c9-2efe0569d655", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "24d3aa97-4880-4434-8b2f-10cc376f4177", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4dfc0a25-e078-4288-b287-a8800157ed99", + "value": "6117" + }, + { + "description": "Educational Support Services", + "related": [ + { + "dest-uuid": "4dfc0a25-e078-4288-b287-a8800157ed99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "24d3aa97-4880-4434-8b2f-10cc376f4177", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6e528f4b-70e5-4049-a9c9-2efe0569d655", + "value": "61171" + }, + { + "description": "Educational Support Services", + "related": [ + { + "dest-uuid": "4dfc0a25-e078-4288-b287-a8800157ed99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6e528f4b-70e5-4049-a9c9-2efe0569d655", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "24d3aa97-4880-4434-8b2f-10cc376f4177", + "value": "611710" + }, + { + "description": "Health Care and Social Assistance", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "27f26c8f-7eb1-4c9e-ae38-28167616a58b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cca216a0-7163-473a-a3a8-3947fd1b0499", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a5584562-7ab6-4e4f-ad20-a01836397036", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "18513e40-1088-4b18-9d2a-f71cea9159c9", + "value": "62" + }, + { + "description": "Ambulatory Health Care Services", + "related": [ + { + "dest-uuid": "18513e40-1088-4b18-9d2a-f71cea9159c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "31b13711-f097-454a-a7a2-dc1999a1f0d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2857d8c2-eba8-49b3-a5e6-a1b040ac3e00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b41fa1ec-8d2e-46ed-b286-a2b9536fa5fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fb4b567d-3756-4492-a1e1-333ac5a313ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "value": "621" + }, + { + "description": "Offices of Physicians", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d0a97ee3-5713-4048-b90a-966a15d772b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e841b580-3bd5-4260-9aef-7743f01f5fb8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b235c823-5d6e-4659-bec0-15ed06e769c2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "31b13711-f097-454a-a7a2-dc1999a1f0d3", + "value": "6211" + }, + { + "description": "Offices of Physicians", + "related": [ + { + "dest-uuid": "31b13711-f097-454a-a7a2-dc1999a1f0d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d0a97ee3-5713-4048-b90a-966a15d772b7", + "value": "62111" + }, + { + "description": "Offices of Physicians (except Mental Health Specialists) ", + "related": [ + { + "dest-uuid": "31b13711-f097-454a-a7a2-dc1999a1f0d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e841b580-3bd5-4260-9aef-7743f01f5fb8", + "value": "621111" + }, + { + "description": "Offices of Physicians, Mental Health Specialists ", + "related": [ + { + "dest-uuid": "31b13711-f097-454a-a7a2-dc1999a1f0d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b235c823-5d6e-4659-bec0-15ed06e769c2", + "value": "621112" + }, + { + "description": "Offices of Dentists", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b0733a32-dc98-4a80-bd49-c62656b8ef28", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d7e1180-6635-496f-ba87-ec916b552e6a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2857d8c2-eba8-49b3-a5e6-a1b040ac3e00", + "value": "6212" + }, + { + "description": "Offices of Dentists", + "related": [ + { + "dest-uuid": "2857d8c2-eba8-49b3-a5e6-a1b040ac3e00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3d7e1180-6635-496f-ba87-ec916b552e6a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b0733a32-dc98-4a80-bd49-c62656b8ef28", + "value": "62121" + }, + { + "description": "Offices of Dentists ", + "related": [ + { + "dest-uuid": "2857d8c2-eba8-49b3-a5e6-a1b040ac3e00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b0733a32-dc98-4a80-bd49-c62656b8ef28", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3d7e1180-6635-496f-ba87-ec916b552e6a", + "value": "621210" + }, + { + "description": "Offices of Other Health Practitioners", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a4111b4a-7888-4a24-970e-4e4ef5799aca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7e01542c-dad8-4a0b-8be1-0c63e657e466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5dbc9262-485b-42fb-89bb-71eff3f2dd1a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "aced7cf4-0d84-411c-93ee-5a639aa177c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6b1c4d57-185d-4e8b-b1b7-533184c17dec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "eb506a22-979f-43ff-b826-2f546a946d8c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6ed835ab-3ab1-4e0e-9a75-882dd7a118e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "990963ed-48bf-499e-8960-e7dc168e77a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fb3a260d-3766-45dc-a382-888faababcf4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d80df1cc-7708-4750-a719-84cf8a638b14", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a2a99f1d-cf03-46a1-ab0c-0b4ce5651447", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "value": "6213" + }, + { + "description": "Offices of Chiropractors", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7e01542c-dad8-4a0b-8be1-0c63e657e466", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a4111b4a-7888-4a24-970e-4e4ef5799aca", + "value": "62131" + }, + { + "description": "Offices of Chiropractors ", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a4111b4a-7888-4a24-970e-4e4ef5799aca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7e01542c-dad8-4a0b-8be1-0c63e657e466", + "value": "621310" + }, + { + "description": "Offices of Optometrists", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "aced7cf4-0d84-411c-93ee-5a639aa177c1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5dbc9262-485b-42fb-89bb-71eff3f2dd1a", + "value": "62132" + }, + { + "description": "Offices of Optometrists", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5dbc9262-485b-42fb-89bb-71eff3f2dd1a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "aced7cf4-0d84-411c-93ee-5a639aa177c1", + "value": "621320" + }, + { + "description": "Offices of Mental Health Practitioners (except Physicians)", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eb506a22-979f-43ff-b826-2f546a946d8c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6b1c4d57-185d-4e8b-b1b7-533184c17dec", + "value": "62133" + }, + { + "description": "Offices of Mental Health Practitioners (except Physicians) ", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6b1c4d57-185d-4e8b-b1b7-533184c17dec", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "eb506a22-979f-43ff-b826-2f546a946d8c", + "value": "621330" + }, + { + "description": "Offices of Physical, Occupational and Speech Therapists, and Audiologists", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "990963ed-48bf-499e-8960-e7dc168e77a8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6ed835ab-3ab1-4e0e-9a75-882dd7a118e8", + "value": "62134" + }, + { + "description": "Offices of Physical, Occupational and Speech Therapists, and Audiologists ", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6ed835ab-3ab1-4e0e-9a75-882dd7a118e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "990963ed-48bf-499e-8960-e7dc168e77a8", + "value": "621340" + }, + { + "description": "Offices of All Other Health Practitioners", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fb3a260d-3766-45dc-a382-888faababcf4", + "value": "62139" + }, + { + "description": "Offices of Podiatrists ", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d80df1cc-7708-4750-a719-84cf8a638b14", + "value": "621391" + }, + { + "description": "Offices of All Other Miscellaneous Health Practitioners ", + "related": [ + { + "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a2a99f1d-cf03-46a1-ab0c-0b4ce5651447", + "value": "621399" + }, + { + "description": "Outpatient Care Centers", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ff2f8a8e-a367-4348-84d5-c28bd7a6c524", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "19c02a5e-fabb-4108-9093-6590aa8984b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d695fcd7-aade-4db8-b56d-e32d02f22b01", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "96fe629f-2e7d-4009-8665-29272d9016ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1cbe0f39-f939-431a-aebe-1545500f9d22", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3c0e026b-7d4a-4d65-8689-924c9720fab7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3084e080-3e4b-4ae9-8599-fce9bbe9676d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f191fc28-79ef-431b-96b9-27e1834d2840", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7e06e1ae-9e08-4318-8753-e710a0c72309", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "value": "6214" + }, + { + "description": "Family Planning Centers", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "19c02a5e-fabb-4108-9093-6590aa8984b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ff2f8a8e-a367-4348-84d5-c28bd7a6c524", + "value": "62141" + }, + { + "description": "Family Planning Centers ", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ff2f8a8e-a367-4348-84d5-c28bd7a6c524", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "19c02a5e-fabb-4108-9093-6590aa8984b6", + "value": "621410" + }, + { + "description": "Outpatient Mental Health and Substance Abuse Centers", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "96fe629f-2e7d-4009-8665-29272d9016ca", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d695fcd7-aade-4db8-b56d-e32d02f22b01", + "value": "62142" + }, + { + "description": "Outpatient Mental Health and Substance Abuse Centers ", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d695fcd7-aade-4db8-b56d-e32d02f22b01", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "96fe629f-2e7d-4009-8665-29272d9016ca", + "value": "621420" + }, + { + "description": "Other Outpatient Care Centers", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1cbe0f39-f939-431a-aebe-1545500f9d22", + "value": "62149" + }, + { + "description": "HMO Medical Centers ", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3c0e026b-7d4a-4d65-8689-924c9720fab7", + "value": "621491" + }, + { + "description": "Kidney Dialysis Centers ", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3084e080-3e4b-4ae9-8599-fce9bbe9676d", + "value": "621492" + }, + { + "description": "Freestanding Ambulatory Surgical and Emergency Centers ", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f191fc28-79ef-431b-96b9-27e1834d2840", + "value": "621493" + }, + { + "description": "All Other Outpatient Care Centers ", + "related": [ + { + "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "7e06e1ae-9e08-4318-8753-e710a0c72309", + "value": "621498" + }, + { + "description": "Medical and Diagnostic Laboratories", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "eb25a68e-53b6-4174-aab1-78ab4ed47e20", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e7718d62-b8ea-4be1-999b-4da4c2db115a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "45a5fc7c-ec9d-4bea-8677-4fe64d6c5032", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b41fa1ec-8d2e-46ed-b286-a2b9536fa5fa", + "value": "6215" + }, + { + "description": "Medical and Diagnostic Laboratories", + "related": [ + { + "dest-uuid": "b41fa1ec-8d2e-46ed-b286-a2b9536fa5fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "eb25a68e-53b6-4174-aab1-78ab4ed47e20", + "value": "62151" + }, + { + "description": "Medical Laboratories ", + "related": [ + { + "dest-uuid": "b41fa1ec-8d2e-46ed-b286-a2b9536fa5fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e7718d62-b8ea-4be1-999b-4da4c2db115a", + "value": "621511" + }, + { + "description": "Diagnostic Imaging Centers ", + "related": [ + { + "dest-uuid": "b41fa1ec-8d2e-46ed-b286-a2b9536fa5fa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "45a5fc7c-ec9d-4bea-8677-4fe64d6c5032", + "value": "621512" + }, + { + "description": "Home Health Care Services", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c524a9c1-a949-4537-9932-71557f101f02", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9fba7bf6-1284-4940-a619-d993c72a89be", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "fb4b567d-3756-4492-a1e1-333ac5a313ff", + "value": "6216" + }, + { + "description": "Home Health Care Services", + "related": [ + { + "dest-uuid": "fb4b567d-3756-4492-a1e1-333ac5a313ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9fba7bf6-1284-4940-a619-d993c72a89be", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c524a9c1-a949-4537-9932-71557f101f02", + "value": "62161" + }, + { + "description": "Home Health Care Services", + "related": [ + { + "dest-uuid": "fb4b567d-3756-4492-a1e1-333ac5a313ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c524a9c1-a949-4537-9932-71557f101f02", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9fba7bf6-1284-4940-a619-d993c72a89be", + "value": "621610" + }, + { + "description": "Other Ambulatory Health Care Services", + "related": [ + { + "dest-uuid": "b97b1692-7aab-44f8-9de1-087ea9a74b00", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a26368ce-f01a-426a-9e6d-39516e82dbf5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cf357f67-6322-4cac-b1bd-d1346f39b579", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c138bdf5-7129-415f-bddd-404a69ae7d67", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "be139270-a1fe-4b70-a73d-8b5c05026be3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "12bbb779-2ab7-4a58-b732-c3e15d128970", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", + "value": "6219" + }, + { + "description": "Ambulance Services", + "related": [ + { + "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cf357f67-6322-4cac-b1bd-d1346f39b579", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a26368ce-f01a-426a-9e6d-39516e82dbf5", + "value": "62191" + }, + { + "description": "Ambulance Services ", + "related": [ + { + "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a26368ce-f01a-426a-9e6d-39516e82dbf5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cf357f67-6322-4cac-b1bd-d1346f39b579", + "value": "621910" + }, + { + "description": "All Other Ambulatory Health Care Services", + "related": [ + { + "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c138bdf5-7129-415f-bddd-404a69ae7d67", + "value": "62199" + }, + { + "description": "Blood and Organ Banks ", + "related": [ + { + "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "be139270-a1fe-4b70-a73d-8b5c05026be3", + "value": "621991" + }, + { + "description": "All Other Miscellaneous Ambulatory Health Care Services ", + "related": [ + { + "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "12bbb779-2ab7-4a58-b732-c3e15d128970", + "value": "621999" + }, + { + "description": "Hospitals", + "related": [ + { + "dest-uuid": "18513e40-1088-4b18-9d2a-f71cea9159c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d8eb4461-48d5-4f91-b7b5-eac02152c0e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e6b7ee44-6d3c-42c5-82d8-f4813c330d76", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f90cd6c1-d73b-47be-b3df-f9c72c6ba8e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "27f26c8f-7eb1-4c9e-ae38-28167616a58b", + "value": "622" + }, + { + "description": "General Medical and Surgical Hospitals", + "related": [ + { + "dest-uuid": "27f26c8f-7eb1-4c9e-ae38-28167616a58b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3c1d2d14-ed8f-4452-a2fd-3d9b31168715", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ddb1d476-edbc-4525-8cfc-2c0901614c6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d8eb4461-48d5-4f91-b7b5-eac02152c0e8", + "value": "6221" + }, + { + "description": "General Medical and Surgical Hospitals", + "related": [ + { + "dest-uuid": "d8eb4461-48d5-4f91-b7b5-eac02152c0e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddb1d476-edbc-4525-8cfc-2c0901614c6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3c1d2d14-ed8f-4452-a2fd-3d9b31168715", + "value": "62211" + }, + { + "description": "General Medical and Surgical Hospitals ", + "related": [ + { + "dest-uuid": "d8eb4461-48d5-4f91-b7b5-eac02152c0e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3c1d2d14-ed8f-4452-a2fd-3d9b31168715", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ddb1d476-edbc-4525-8cfc-2c0901614c6d", + "value": "622110" + }, + { + "description": "Psychiatric and Substance Abuse Hospitals", + "related": [ + { + "dest-uuid": "27f26c8f-7eb1-4c9e-ae38-28167616a58b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e8242c0a-2558-4633-9514-5c19b89c2357", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "716e8811-077f-40d3-96b4-e44f7acebd40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e6b7ee44-6d3c-42c5-82d8-f4813c330d76", + "value": "6222" + }, + { + "description": "Psychiatric and Substance Abuse Hospitals", + "related": [ + { + "dest-uuid": "e6b7ee44-6d3c-42c5-82d8-f4813c330d76", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "716e8811-077f-40d3-96b4-e44f7acebd40", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e8242c0a-2558-4633-9514-5c19b89c2357", + "value": "62221" + }, + { + "description": "Psychiatric and Substance Abuse Hospitals ", + "related": [ + { + "dest-uuid": "e6b7ee44-6d3c-42c5-82d8-f4813c330d76", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e8242c0a-2558-4633-9514-5c19b89c2357", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "716e8811-077f-40d3-96b4-e44f7acebd40", + "value": "622210" + }, + { + "description": "Specialty (except Psychiatric and Substance Abuse) Hospitals", + "related": [ + { + "dest-uuid": "27f26c8f-7eb1-4c9e-ae38-28167616a58b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "06f37c02-b17e-4811-879b-1fd1d2faf7a9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0312dfce-eb2a-42ff-a3fa-d21538390192", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f90cd6c1-d73b-47be-b3df-f9c72c6ba8e8", + "value": "6223" + }, + { + "description": "Specialty (except Psychiatric and Substance Abuse) Hospitals", + "related": [ + { + "dest-uuid": "f90cd6c1-d73b-47be-b3df-f9c72c6ba8e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0312dfce-eb2a-42ff-a3fa-d21538390192", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "06f37c02-b17e-4811-879b-1fd1d2faf7a9", + "value": "62231" + }, + { + "description": "Specialty (except Psychiatric and Substance Abuse) Hospitals ", + "related": [ + { + "dest-uuid": "f90cd6c1-d73b-47be-b3df-f9c72c6ba8e8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "06f37c02-b17e-4811-879b-1fd1d2faf7a9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0312dfce-eb2a-42ff-a3fa-d21538390192", + "value": "622310" + }, + { + "description": "Nursing and Residential Care Facilities", + "related": [ + { + "dest-uuid": "18513e40-1088-4b18-9d2a-f71cea9159c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d411da93-c7cd-4875-9328-0685379cc907", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0b9bd47c-dbfe-4dcf-93b0-b0ff2af296a2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "69ee9ed8-0c6b-4caf-8e7b-da308dc5a00c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cca216a0-7163-473a-a3a8-3947fd1b0499", + "value": "623" + }, + { + "description": "Nursing Care Facilities (Skilled Nursing Facilities)", + "related": [ + { + "dest-uuid": "cca216a0-7163-473a-a3a8-3947fd1b0499", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "75fe55cc-5d03-40ae-bc47-6527dd26b3fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8b0cfdf2-dd1d-44b9-ad1d-05bdbc67094c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "d411da93-c7cd-4875-9328-0685379cc907", + "value": "6231" + }, + { + "description": "Nursing Care Facilities (Skilled Nursing Facilities)", + "related": [ + { + "dest-uuid": "d411da93-c7cd-4875-9328-0685379cc907", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8b0cfdf2-dd1d-44b9-ad1d-05bdbc67094c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "75fe55cc-5d03-40ae-bc47-6527dd26b3fc", + "value": "62311" + }, + { + "description": "Nursing Care Facilities (Skilled Nursing Facilities) ", + "related": [ + { + "dest-uuid": "d411da93-c7cd-4875-9328-0685379cc907", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "75fe55cc-5d03-40ae-bc47-6527dd26b3fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8b0cfdf2-dd1d-44b9-ad1d-05bdbc67094c", + "value": "623110" + }, + { + "description": "Residential Intellectual and Developmental Disability, Mental Health, and Substance Abuse Facilities", + "related": [ + { + "dest-uuid": "cca216a0-7163-473a-a3a8-3947fd1b0499", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5a0e6925-ebbf-4a8d-9413-d4c2cf5fb918", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2d5b5621-c58e-447a-869c-863c7be87275", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a41dd33a-1edc-4f87-887f-11aa54421e11", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bfb77424-8c4a-4bab-8cd4-8666eecc4e94", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", + "value": "6232" + }, + { + "description": "Residential Intellectual and Developmental Disability Facilities", + "related": [ + { + "dest-uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2d5b5621-c58e-447a-869c-863c7be87275", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5a0e6925-ebbf-4a8d-9413-d4c2cf5fb918", + "value": "62321" + }, + { + "description": "Residential Intellectual and Developmental Disability Facilities ", + "related": [ + { + "dest-uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5a0e6925-ebbf-4a8d-9413-d4c2cf5fb918", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2d5b5621-c58e-447a-869c-863c7be87275", + "value": "623210" + }, + { + "description": "Residential Mental Health and Substance Abuse Facilities", + "related": [ + { + "dest-uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bfb77424-8c4a-4bab-8cd4-8666eecc4e94", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a41dd33a-1edc-4f87-887f-11aa54421e11", + "value": "62322" + }, + { + "description": "Residential Mental Health and Substance Abuse Facilities ", + "related": [ + { + "dest-uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a41dd33a-1edc-4f87-887f-11aa54421e11", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bfb77424-8c4a-4bab-8cd4-8666eecc4e94", + "value": "623220" + }, + { + "description": "Continuing Care Retirement Communities and Assisted Living Facilities for the Elderly", + "related": [ + { + "dest-uuid": "cca216a0-7163-473a-a3a8-3947fd1b0499", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d77d30db-b719-4613-895c-3b0072f21bd8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "21d43b19-e1bf-49b5-995d-4b6ae480930e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8a0f239e-e1d4-4e53-af90-bd156c28961f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0b9bd47c-dbfe-4dcf-93b0-b0ff2af296a2", + "value": "6233" + }, + { + "description": "Continuing Care Retirement Communities and Assisted Living Facilities for the Elderly", + "related": [ + { + "dest-uuid": "0b9bd47c-dbfe-4dcf-93b0-b0ff2af296a2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d77d30db-b719-4613-895c-3b0072f21bd8", + "value": "62331" + }, + { + "description": "Continuing Care Retirement Communities ", + "related": [ + { + "dest-uuid": "0b9bd47c-dbfe-4dcf-93b0-b0ff2af296a2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "21d43b19-e1bf-49b5-995d-4b6ae480930e", + "value": "623311" + }, + { + "description": "Assisted Living Facilities for the Elderly ", + "related": [ + { + "dest-uuid": "0b9bd47c-dbfe-4dcf-93b0-b0ff2af296a2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8a0f239e-e1d4-4e53-af90-bd156c28961f", + "value": "623312" + }, + { + "description": "Other Residential Care Facilities", + "related": [ + { + "dest-uuid": "cca216a0-7163-473a-a3a8-3947fd1b0499", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "38da91a2-8ce0-4ccd-a0f0-1aac6bd01981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1a7d8618-f320-429d-86b3-db244452c4e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "69ee9ed8-0c6b-4caf-8e7b-da308dc5a00c", + "value": "6239" + }, + { + "description": "Other Residential Care Facilities", + "related": [ + { + "dest-uuid": "69ee9ed8-0c6b-4caf-8e7b-da308dc5a00c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1a7d8618-f320-429d-86b3-db244452c4e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "38da91a2-8ce0-4ccd-a0f0-1aac6bd01981", + "value": "62399" + }, + { + "description": "Other Residential Care Facilities ", + "related": [ + { + "dest-uuid": "69ee9ed8-0c6b-4caf-8e7b-da308dc5a00c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "38da91a2-8ce0-4ccd-a0f0-1aac6bd01981", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1a7d8618-f320-429d-86b3-db244452c4e1", + "value": "623990" + }, + { + "description": "Social Assistance", + "related": [ + { + "dest-uuid": "18513e40-1088-4b18-9d2a-f71cea9159c9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9f5a2cb5-4b9b-4b8c-af55-36ba59e0c66e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "75c088ec-3565-4d65-92b6-92133c4fa75d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a5584562-7ab6-4e4f-ad20-a01836397036", + "value": "624" + }, + { + "description": "Individual and Family Services", + "related": [ + { + "dest-uuid": "a5584562-7ab6-4e4f-ad20-a01836397036", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "097cc29a-9b88-4822-8680-5be1774a7d43", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f141f018-6205-4986-b28d-d6bfec52482b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f54d5cd3-c0ff-4e3b-b94c-6e5975f8cc37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cc519db2-91ab-4521-b6d6-dd8b41200cac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "692331eb-c669-454a-be42-7b50d57c3667", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fe45fd0a-2a6f-44ce-bca8-a5fa20f301b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "value": "6241" + }, + { + "description": "Child and Youth Services", + "related": [ + { + "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f141f018-6205-4986-b28d-d6bfec52482b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "097cc29a-9b88-4822-8680-5be1774a7d43", + "value": "62411" + }, + { + "description": "Child and Youth Services ", + "related": [ + { + "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "097cc29a-9b88-4822-8680-5be1774a7d43", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f141f018-6205-4986-b28d-d6bfec52482b", + "value": "624110" + }, + { + "description": "Services for the Elderly and Persons with Disabilities", + "related": [ + { + "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cc519db2-91ab-4521-b6d6-dd8b41200cac", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f54d5cd3-c0ff-4e3b-b94c-6e5975f8cc37", + "value": "62412" + }, + { + "description": "Services for the Elderly and Persons with Disabilities ", + "related": [ + { + "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f54d5cd3-c0ff-4e3b-b94c-6e5975f8cc37", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cc519db2-91ab-4521-b6d6-dd8b41200cac", + "value": "624120" + }, + { + "description": "Other Individual and Family Services", + "related": [ + { + "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fe45fd0a-2a6f-44ce-bca8-a5fa20f301b1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "692331eb-c669-454a-be42-7b50d57c3667", + "value": "62419" + }, + { + "description": "Other Individual and Family Services ", + "related": [ + { + "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "692331eb-c669-454a-be42-7b50d57c3667", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fe45fd0a-2a6f-44ce-bca8-a5fa20f301b1", + "value": "624190" + }, + { + "description": "Community Food and Housing, and Emergency and Other Relief Services", + "related": [ + { + "dest-uuid": "a5584562-7ab6-4e4f-ad20-a01836397036", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bf0b67b2-9984-456d-80d5-6623228a258c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "df2427f4-696c-4bef-8009-3467ee36e916", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c606e615-fbf9-47c6-9cf8-4d5978395867", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ab4610aa-50c6-4c0d-acb2-293270c21901", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4673c7d7-e995-4fc8-9ef9-a6bf780e144f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1008627f-25d2-4662-90f9-523d179cfc96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d3f16082-cb73-4c97-b4da-8ed41d262d60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "value": "6242" + }, + { + "description": "Community Food Services", + "related": [ + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "df2427f4-696c-4bef-8009-3467ee36e916", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bf0b67b2-9984-456d-80d5-6623228a258c", + "value": "62421" + }, + { + "description": "Community Food Services ", + "related": [ + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bf0b67b2-9984-456d-80d5-6623228a258c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "df2427f4-696c-4bef-8009-3467ee36e916", + "value": "624210" + }, + { + "description": "Community Housing Services", + "related": [ + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c606e615-fbf9-47c6-9cf8-4d5978395867", + "value": "62422" + }, + { + "description": "Temporary Shelters ", + "related": [ + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ab4610aa-50c6-4c0d-acb2-293270c21901", + "value": "624221" + }, + { + "description": "Other Community Housing Services ", + "related": [ + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4673c7d7-e995-4fc8-9ef9-a6bf780e144f", + "value": "624229" + }, + { + "description": "Emergency and Other Relief Services", + "related": [ + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d3f16082-cb73-4c97-b4da-8ed41d262d60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1008627f-25d2-4662-90f9-523d179cfc96", + "value": "62423" + }, + { + "description": "Emergency and Other Relief Services ", + "related": [ + { + "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1008627f-25d2-4662-90f9-523d179cfc96", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d3f16082-cb73-4c97-b4da-8ed41d262d60", + "value": "624230" + }, + { + "description": "Vocational Rehabilitation Services", + "related": [ + { + "dest-uuid": "a5584562-7ab6-4e4f-ad20-a01836397036", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "feb5b7c1-a159-40ef-b28f-4452b39f3377", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "368db0bb-d984-4aaf-b7ca-0d750ddb4c10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9f5a2cb5-4b9b-4b8c-af55-36ba59e0c66e", + "value": "6243" + }, + { + "description": "Vocational Rehabilitation Services", + "related": [ + { + "dest-uuid": "9f5a2cb5-4b9b-4b8c-af55-36ba59e0c66e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "368db0bb-d984-4aaf-b7ca-0d750ddb4c10", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "feb5b7c1-a159-40ef-b28f-4452b39f3377", + "value": "62431" + }, + { + "description": "Vocational Rehabilitation Services ", + "related": [ + { + "dest-uuid": "9f5a2cb5-4b9b-4b8c-af55-36ba59e0c66e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "feb5b7c1-a159-40ef-b28f-4452b39f3377", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "368db0bb-d984-4aaf-b7ca-0d750ddb4c10", + "value": "624310" + }, + { + "description": "Child Care Services", + "related": [ + { + "dest-uuid": "a5584562-7ab6-4e4f-ad20-a01836397036", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "44d896eb-5314-4b01-b67e-0a24d04a5500", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b6ec4bf1-1de9-4b73-86dc-d06c0e287eaa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "75c088ec-3565-4d65-92b6-92133c4fa75d", + "value": "6244" + }, + { + "description": "Child Care Services", + "related": [ + { + "dest-uuid": "75c088ec-3565-4d65-92b6-92133c4fa75d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b6ec4bf1-1de9-4b73-86dc-d06c0e287eaa", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "44d896eb-5314-4b01-b67e-0a24d04a5500", + "value": "62441" + }, + { + "description": "Child Care Services ", + "related": [ + { + "dest-uuid": "75c088ec-3565-4d65-92b6-92133c4fa75d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "44d896eb-5314-4b01-b67e-0a24d04a5500", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b6ec4bf1-1de9-4b73-86dc-d06c0e287eaa", + "value": "624410" + }, + { + "description": "Arts, Entertainment, and Recreation", + "related": [ + { + "dest-uuid": "0bf1e342-53cf-4994-b791-1a631d079014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f8597943-93f9-4fdc-a649-891282e3ce3e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b80a915f-5bdd-459f-afdf-9c19d141c40f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6de370ce-13fa-4a4b-8e2c-6c3d43ceec79", + "value": "71" + }, + { + "description": "Performing Arts, Spectator Sports, and Related Industries", + "related": [ + { + "dest-uuid": "6de370ce-13fa-4a4b-8e2c-6c3d43ceec79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f90b7338-7cc3-46a4-81a3-3d9d7a711e35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a80731be-afd3-4687-977c-7adbe9eee2ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0bf1e342-53cf-4994-b791-1a631d079014", + "value": "711" + }, + { + "description": "Performing Arts Companies", + "related": [ + { + "dest-uuid": "0bf1e342-53cf-4994-b791-1a631d079014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "07af7ec1-1504-46ca-954d-3af497a5b13c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0b6b1232-980c-446e-9e0a-dbfebe4d05d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e7c481a3-3422-4daf-a91a-1775bbe9e23d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "29696d08-2d53-4d07-a174-3e51e5c58a53", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "717f3b9d-9f7d-452c-8e0d-8d697d8e35ae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3dca4506-9a0f-4322-8505-c2d197f910e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8cf13c65-b3bb-4332-83b9-af15c98232d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "43a41809-6c17-47d6-8136-27bdc675402f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "value": "7111" + }, + { + "description": "Theater Companies and Dinner Theaters", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0b6b1232-980c-446e-9e0a-dbfebe4d05d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "07af7ec1-1504-46ca-954d-3af497a5b13c", + "value": "71111" + }, + { + "description": "Theater Companies and Dinner Theaters ", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "07af7ec1-1504-46ca-954d-3af497a5b13c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0b6b1232-980c-446e-9e0a-dbfebe4d05d8", + "value": "711110" + }, + { + "description": "Dance Companies", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "29696d08-2d53-4d07-a174-3e51e5c58a53", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e7c481a3-3422-4daf-a91a-1775bbe9e23d", + "value": "71112" + }, + { + "description": "Dance Companies ", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e7c481a3-3422-4daf-a91a-1775bbe9e23d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "29696d08-2d53-4d07-a174-3e51e5c58a53", + "value": "711120" + }, + { + "description": "Musical Groups and Artists", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3dca4506-9a0f-4322-8505-c2d197f910e1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "717f3b9d-9f7d-452c-8e0d-8d697d8e35ae", + "value": "71113" + }, + { + "description": "Musical Groups and Artists ", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "717f3b9d-9f7d-452c-8e0d-8d697d8e35ae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3dca4506-9a0f-4322-8505-c2d197f910e1", + "value": "711130" + }, + { + "description": "Other Performing Arts Companies", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "43a41809-6c17-47d6-8136-27bdc675402f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8cf13c65-b3bb-4332-83b9-af15c98232d8", + "value": "71119" + }, + { + "description": "Other Performing Arts Companies ", + "related": [ + { + "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8cf13c65-b3bb-4332-83b9-af15c98232d8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "43a41809-6c17-47d6-8136-27bdc675402f", + "value": "711190" + }, + { + "description": "Spectator Sports", + "related": [ + { + "dest-uuid": "0bf1e342-53cf-4994-b791-1a631d079014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "043d5b04-3de9-49f6-9747-a2421f253bd5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "50f588e1-e313-4761-8b89-bbc228301b76", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fdace711-33d2-4c9f-ab5a-55f012544423", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d8fc28f6-0c93-49fd-97f6-2a29d2f97854", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", + "value": "7112" + }, + { + "description": "Spectator Sports", + "related": [ + { + "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "043d5b04-3de9-49f6-9747-a2421f253bd5", + "value": "71121" + }, + { + "description": "Sports Teams and Clubs ", + "related": [ + { + "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "50f588e1-e313-4761-8b89-bbc228301b76", + "value": "711211" + }, + { + "description": "Racetracks ", + "related": [ + { + "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "fdace711-33d2-4c9f-ab5a-55f012544423", + "value": "711212" + }, + { + "description": "Other Spectator Sports ", + "related": [ + { + "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d8fc28f6-0c93-49fd-97f6-2a29d2f97854", + "value": "711219" + }, + { + "description": "Promoters of Performing Arts, Sports, and Similar Events", + "related": [ + { + "dest-uuid": "0bf1e342-53cf-4994-b791-1a631d079014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "10a62099-a3f4-4e69-8431-f531da7c1b18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "528f7cd2-3496-45f0-8c3d-28ab48aadb1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d1e26b61-f5ad-462f-a4cb-bec57fa774eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "32e15463-33b6-4e39-89d3-fe46b28c1c17", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", + "value": "7113" + }, + { + "description": "Promoters of Performing Arts, Sports, and Similar Events with Facilities", + "related": [ + { + "dest-uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "528f7cd2-3496-45f0-8c3d-28ab48aadb1c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "10a62099-a3f4-4e69-8431-f531da7c1b18", + "value": "71131" + }, + { + "description": "Promoters of Performing Arts, Sports, and Similar Events with Facilities ", + "related": [ + { + "dest-uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "10a62099-a3f4-4e69-8431-f531da7c1b18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "528f7cd2-3496-45f0-8c3d-28ab48aadb1c", + "value": "711310" + }, + { + "description": "Promoters of Performing Arts, Sports, and Similar Events without Facilities", + "related": [ + { + "dest-uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "32e15463-33b6-4e39-89d3-fe46b28c1c17", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d1e26b61-f5ad-462f-a4cb-bec57fa774eb", + "value": "71132" + }, + { + "description": "Promoters of Performing Arts, Sports, and Similar Events without Facilities ", + "related": [ + { + "dest-uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d1e26b61-f5ad-462f-a4cb-bec57fa774eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "32e15463-33b6-4e39-89d3-fe46b28c1c17", + "value": "711320" + }, + { + "description": "Agents and Managers for Artists, Athletes, Entertainers, and Other Public Figures", + "related": [ + { + "dest-uuid": "0bf1e342-53cf-4994-b791-1a631d079014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a43b8f1a-e10c-49f6-bf40-2d7a71cfa6df", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5e17efc8-3ffe-4702-8b50-073b3af55aa9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f90b7338-7cc3-46a4-81a3-3d9d7a711e35", + "value": "7114" + }, + { + "description": "Agents and Managers for Artists, Athletes, Entertainers, and Other Public Figures", + "related": [ + { + "dest-uuid": "f90b7338-7cc3-46a4-81a3-3d9d7a711e35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5e17efc8-3ffe-4702-8b50-073b3af55aa9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a43b8f1a-e10c-49f6-bf40-2d7a71cfa6df", + "value": "71141" + }, + { + "description": "Agents and Managers for Artists, Athletes, Entertainers, and Other Public Figures", + "related": [ + { + "dest-uuid": "f90b7338-7cc3-46a4-81a3-3d9d7a711e35", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a43b8f1a-e10c-49f6-bf40-2d7a71cfa6df", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5e17efc8-3ffe-4702-8b50-073b3af55aa9", + "value": "711410" + }, + { + "description": "Independent Artists, Writers, and Performers", + "related": [ + { + "dest-uuid": "0bf1e342-53cf-4994-b791-1a631d079014", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1de3d16a-5ff3-4ad3-be13-c469ac0b77c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "61a33dda-d987-47e6-bda5-deac2e25cb13", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "a80731be-afd3-4687-977c-7adbe9eee2ab", + "value": "7115" + }, + { + "description": "Independent Artists, Writers, and Performers", + "related": [ + { + "dest-uuid": "a80731be-afd3-4687-977c-7adbe9eee2ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "61a33dda-d987-47e6-bda5-deac2e25cb13", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1de3d16a-5ff3-4ad3-be13-c469ac0b77c6", + "value": "71151" + }, + { + "description": "Independent Artists, Writers, and Performers ", + "related": [ + { + "dest-uuid": "a80731be-afd3-4687-977c-7adbe9eee2ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1de3d16a-5ff3-4ad3-be13-c469ac0b77c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "61a33dda-d987-47e6-bda5-deac2e25cb13", + "value": "711510" + }, + { + "description": "Museums, Historical Sites, and Similar Institutions", + "related": [ + { + "dest-uuid": "6de370ce-13fa-4a4b-8e2c-6c3d43ceec79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f8597943-93f9-4fdc-a649-891282e3ce3e", + "value": "712" + }, + { + "description": "Museums, Historical Sites, and Similar Institutions", + "related": [ + { + "dest-uuid": "f8597943-93f9-4fdc-a649-891282e3ce3e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "db3bafd9-29c5-4c17-8729-61efd4e0d7b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "306ba3f1-e32d-41e9-8ef5-c7579698ed0e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f9ab5aee-7769-4ce4-bdf4-e803d6b89e79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c8d1434f-e9ce-4c00-91bd-523748fb009c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6feb8de0-0206-48c9-8b32-b2229ddc44b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cb2b7a4a-f078-4670-bb01-f0657c7a7286", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a434fcb4-1f4d-4fc9-9f75-9a7a15e03428", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "34b4cd2a-1ced-415d-afb3-a4782aac3010", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "value": "7121" + }, + { + "description": "Museums", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "306ba3f1-e32d-41e9-8ef5-c7579698ed0e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "db3bafd9-29c5-4c17-8729-61efd4e0d7b7", + "value": "71211" + }, + { + "description": "Museums ", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "db3bafd9-29c5-4c17-8729-61efd4e0d7b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "306ba3f1-e32d-41e9-8ef5-c7579698ed0e", + "value": "712110" + }, + { + "description": "Historical Sites", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8d1434f-e9ce-4c00-91bd-523748fb009c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f9ab5aee-7769-4ce4-bdf4-e803d6b89e79", + "value": "71212" + }, + { + "description": "Historical Sites", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f9ab5aee-7769-4ce4-bdf4-e803d6b89e79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c8d1434f-e9ce-4c00-91bd-523748fb009c", + "value": "712120" + }, + { + "description": "Zoos and Botanical Gardens", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cb2b7a4a-f078-4670-bb01-f0657c7a7286", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6feb8de0-0206-48c9-8b32-b2229ddc44b0", + "value": "71213" + }, + { + "description": "Zoos and Botanical Gardens ", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6feb8de0-0206-48c9-8b32-b2229ddc44b0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cb2b7a4a-f078-4670-bb01-f0657c7a7286", + "value": "712130" + }, + { + "description": "Nature Parks and Other Similar Institutions", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "34b4cd2a-1ced-415d-afb3-a4782aac3010", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a434fcb4-1f4d-4fc9-9f75-9a7a15e03428", + "value": "71219" + }, + { + "description": "Nature Parks and Other Similar Institutions", + "related": [ + { + "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a434fcb4-1f4d-4fc9-9f75-9a7a15e03428", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "34b4cd2a-1ced-415d-afb3-a4782aac3010", + "value": "712190" + }, + { + "description": "Amusement, Gambling, and Recreation Industries", + "related": [ + { + "dest-uuid": "6de370ce-13fa-4a4b-8e2c-6c3d43ceec79", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2ba66334-fed4-4c91-97d2-f88a309e1128", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8ad528f4-2994-459c-8979-a3306dd12843", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b80a915f-5bdd-459f-afdf-9c19d141c40f", + "value": "713" + }, + { + "description": "Amusement Parks and Arcades", + "related": [ + { + "dest-uuid": "b80a915f-5bdd-459f-afdf-9c19d141c40f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ebbdb1c5-42e5-4225-bea8-0b6026bd3f80", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6ecb4c4d-71fb-4cfe-a410-9d1da4eb69ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3b3f346e-8dff-4bb5-97c3-3b059cea8742", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "47833574-3ba1-485d-a9ea-b5b97b89442a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2ba66334-fed4-4c91-97d2-f88a309e1128", + "value": "7131" + }, + { + "description": "Amusement and Theme Parks", + "related": [ + { + "dest-uuid": "2ba66334-fed4-4c91-97d2-f88a309e1128", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6ecb4c4d-71fb-4cfe-a410-9d1da4eb69ff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ebbdb1c5-42e5-4225-bea8-0b6026bd3f80", + "value": "71311" + }, + { + "description": "Amusement and Theme Parks ", + "related": [ + { + "dest-uuid": "2ba66334-fed4-4c91-97d2-f88a309e1128", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ebbdb1c5-42e5-4225-bea8-0b6026bd3f80", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6ecb4c4d-71fb-4cfe-a410-9d1da4eb69ff", + "value": "713110" + }, + { + "description": "Amusement Arcades", + "related": [ + { + "dest-uuid": "2ba66334-fed4-4c91-97d2-f88a309e1128", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "47833574-3ba1-485d-a9ea-b5b97b89442a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3b3f346e-8dff-4bb5-97c3-3b059cea8742", + "value": "71312" + }, + { + "description": "Amusement Arcades", + "related": [ + { + "dest-uuid": "2ba66334-fed4-4c91-97d2-f88a309e1128", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3b3f346e-8dff-4bb5-97c3-3b059cea8742", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "47833574-3ba1-485d-a9ea-b5b97b89442a", + "value": "713120" + }, + { + "description": "Gambling Industries", + "related": [ + { + "dest-uuid": "b80a915f-5bdd-459f-afdf-9c19d141c40f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9db1c49b-7964-4ec0-b533-34d8b44a0144", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9f8d37c7-84b1-4edc-97ca-4fb5ab940a45", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a3b98cdb-5e07-437f-9ccb-5df960df6391", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6d7cadec-a9d8-4eda-9dde-4e69b0769813", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8ad528f4-2994-459c-8979-a3306dd12843", + "value": "7132" + }, + { + "description": "Casinos (except Casino Hotels)", + "related": [ + { + "dest-uuid": "8ad528f4-2994-459c-8979-a3306dd12843", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9f8d37c7-84b1-4edc-97ca-4fb5ab940a45", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9db1c49b-7964-4ec0-b533-34d8b44a0144", + "value": "71321" + }, + { + "description": "Casinos (except Casino Hotels)", + "related": [ + { + "dest-uuid": "8ad528f4-2994-459c-8979-a3306dd12843", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9db1c49b-7964-4ec0-b533-34d8b44a0144", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9f8d37c7-84b1-4edc-97ca-4fb5ab940a45", + "value": "713210" + }, + { + "description": "Other Gambling Industries", + "related": [ + { + "dest-uuid": "8ad528f4-2994-459c-8979-a3306dd12843", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6d7cadec-a9d8-4eda-9dde-4e69b0769813", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a3b98cdb-5e07-437f-9ccb-5df960df6391", + "value": "71329" + }, + { + "description": "Other Gambling Industries ", + "related": [ + { + "dest-uuid": "8ad528f4-2994-459c-8979-a3306dd12843", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a3b98cdb-5e07-437f-9ccb-5df960df6391", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6d7cadec-a9d8-4eda-9dde-4e69b0769813", + "value": "713290" + }, + { + "description": "Other Amusement and Recreation Industries", + "related": [ + { + "dest-uuid": "b80a915f-5bdd-459f-afdf-9c19d141c40f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9fb5d50b-0b68-470b-af7d-d3cbcaa373a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c0dc82a2-0f20-4861-a509-bd218303c565", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a4cccd71-a3e6-4139-a6ea-2e2b5395202c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4f82fbf4-302c-4f03-8d2b-631b16d0bffe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "af8c3dab-96aa-493c-8113-52983ae94f53", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0155aa37-ad23-4eb7-85bb-e4445eb9d491", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "80fb5c9f-7b33-44ea-9eef-9ab8a18cbb7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "917d7f15-cdd0-4c5a-afd8-aecf5a1f14a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a8e96aa4-2121-4188-9316-70d9795c01ae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ec2ef111-35a9-421e-aadd-73a11362422c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "fed54d76-5c8f-4492-a86e-fcdeb9c69901", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a1384f5e-8341-4133-b9b6-9dd35714dfa9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "value": "7139" + }, + { + "description": "Golf Courses and Country Clubs", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c0dc82a2-0f20-4861-a509-bd218303c565", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9fb5d50b-0b68-470b-af7d-d3cbcaa373a1", + "value": "71391" + }, + { + "description": "Golf Courses and Country Clubs", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9fb5d50b-0b68-470b-af7d-d3cbcaa373a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c0dc82a2-0f20-4861-a509-bd218303c565", + "value": "713910" + }, + { + "description": "Skiing Facilities", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4f82fbf4-302c-4f03-8d2b-631b16d0bffe", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a4cccd71-a3e6-4139-a6ea-2e2b5395202c", + "value": "71392" + }, + { + "description": "Skiing Facilities", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a4cccd71-a3e6-4139-a6ea-2e2b5395202c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4f82fbf4-302c-4f03-8d2b-631b16d0bffe", + "value": "713920" + }, + { + "description": "Marinas", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0155aa37-ad23-4eb7-85bb-e4445eb9d491", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "af8c3dab-96aa-493c-8113-52983ae94f53", + "value": "71393" + }, + { + "description": "Marinas", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "af8c3dab-96aa-493c-8113-52983ae94f53", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0155aa37-ad23-4eb7-85bb-e4445eb9d491", + "value": "713930" + }, + { + "description": "Fitness and Recreational Sports Centers", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "917d7f15-cdd0-4c5a-afd8-aecf5a1f14a1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "80fb5c9f-7b33-44ea-9eef-9ab8a18cbb7c", + "value": "71394" + }, + { + "description": "Fitness and Recreational Sports Centers ", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "80fb5c9f-7b33-44ea-9eef-9ab8a18cbb7c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "917d7f15-cdd0-4c5a-afd8-aecf5a1f14a1", + "value": "713940" + }, + { + "description": "Bowling Centers", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ec2ef111-35a9-421e-aadd-73a11362422c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a8e96aa4-2121-4188-9316-70d9795c01ae", + "value": "71395" + }, + { + "description": "Bowling Centers", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a8e96aa4-2121-4188-9316-70d9795c01ae", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ec2ef111-35a9-421e-aadd-73a11362422c", + "value": "713950" + }, + { + "description": "All Other Amusement and Recreation Industries", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a1384f5e-8341-4133-b9b6-9dd35714dfa9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fed54d76-5c8f-4492-a86e-fcdeb9c69901", + "value": "71399" + }, + { + "description": "All Other Amusement and Recreation Industries ", + "related": [ + { + "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fed54d76-5c8f-4492-a86e-fcdeb9c69901", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a1384f5e-8341-4133-b9b6-9dd35714dfa9", + "value": "713990" + }, + { + "description": "Accommodation and Food Services", + "related": [ + { + "dest-uuid": "ecea94c2-06b6-4dec-bb67-3eb3e698c862", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "35b61fe8-2b04-4f69-b98d-a0299c74e7e3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c98a0bfa-db3a-4b42-b2d9-6abc5f69ae4e", + "value": "72" + }, + { + "description": "Accommodation", + "related": [ + { + "dest-uuid": "c98a0bfa-db3a-4b42-b2d9-6abc5f69ae4e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1320cfd7-11ec-4e4c-a66f-550f03107988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "de6f1021-4cfc-4175-b765-a6f3a818e6ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ecea94c2-06b6-4dec-bb67-3eb3e698c862", + "value": "721" + }, + { + "description": "Traveler Accommodation", + "related": [ + { + "dest-uuid": "ecea94c2-06b6-4dec-bb67-3eb3e698c862", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "32a1c8ac-be56-4d22-8057-d421ea337ec7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ddb59ea7-fb7a-41cc-bde0-a1e967b0046d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "753c47e3-bdf0-4f9b-9ff6-d50db712c56b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6c71103b-e19b-40ad-b13d-8a2474a8bef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c252b729-bf4b-4b24-80cd-963b046fbf54", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8808f23d-4e43-4183-b973-e434b91ae12c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ea731ae6-5fda-4a8f-866f-b2c7c2c50155", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "value": "7211" + }, + { + "description": "Hotels (except Casino Hotels) and Motels", + "related": [ + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ddb59ea7-fb7a-41cc-bde0-a1e967b0046d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "32a1c8ac-be56-4d22-8057-d421ea337ec7", + "value": "72111" + }, + { + "description": "Hotels (except Casino Hotels) and Motels ", + "related": [ + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "32a1c8ac-be56-4d22-8057-d421ea337ec7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ddb59ea7-fb7a-41cc-bde0-a1e967b0046d", + "value": "721110" + }, + { + "description": "Casino Hotels", + "related": [ + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6c71103b-e19b-40ad-b13d-8a2474a8bef6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "753c47e3-bdf0-4f9b-9ff6-d50db712c56b", + "value": "72112" + }, + { + "description": "Casino Hotels", + "related": [ + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "753c47e3-bdf0-4f9b-9ff6-d50db712c56b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6c71103b-e19b-40ad-b13d-8a2474a8bef6", + "value": "721120" + }, + { + "description": "Other Traveler Accommodation", + "related": [ + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c252b729-bf4b-4b24-80cd-963b046fbf54", + "value": "72119" + }, + { + "description": "Bed-and-Breakfast Inns ", + "related": [ + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8808f23d-4e43-4183-b973-e434b91ae12c", + "value": "721191" + }, + { + "description": "All Other Traveler Accommodation ", + "related": [ + { + "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ea731ae6-5fda-4a8f-866f-b2c7c2c50155", + "value": "721199" + }, + { + "description": "RV (Recreational Vehicle) Parks and Recreational Camps", + "related": [ + { + "dest-uuid": "ecea94c2-06b6-4dec-bb67-3eb3e698c862", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5ab6c261-c0fe-48ee-a772-e5b669058864", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9c0c15e9-8f7e-4895-a815-d53a418f0b54", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "70c50373-0e78-4644-a2fb-611c4455664d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1320cfd7-11ec-4e4c-a66f-550f03107988", + "value": "7212" + }, + { + "description": "RV (Recreational Vehicle) Parks and Recreational Camps", + "related": [ + { + "dest-uuid": "1320cfd7-11ec-4e4c-a66f-550f03107988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5ab6c261-c0fe-48ee-a772-e5b669058864", + "value": "72121" + }, + { + "description": "RV (Recreational Vehicle) Parks and Campgrounds ", + "related": [ + { + "dest-uuid": "1320cfd7-11ec-4e4c-a66f-550f03107988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "9c0c15e9-8f7e-4895-a815-d53a418f0b54", + "value": "721211" + }, + { + "description": "Recreational and Vacation Camps (except Campgrounds) ", + "related": [ + { + "dest-uuid": "1320cfd7-11ec-4e4c-a66f-550f03107988", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "70c50373-0e78-4644-a2fb-611c4455664d", + "value": "721214" + }, + { + "description": "Rooming and Boarding Houses, Dormitories, and Workers' Camps", + "related": [ + { + "dest-uuid": "ecea94c2-06b6-4dec-bb67-3eb3e698c862", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3d52530c-fe8b-4343-b42b-aa730f4b5848", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "90dd17e5-f8aa-4f94-958f-9389bc58af26", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "de6f1021-4cfc-4175-b765-a6f3a818e6ef", + "value": "7213" + }, + { + "description": "Rooming and Boarding Houses, Dormitories, and Workers' Camps", + "related": [ + { + "dest-uuid": "de6f1021-4cfc-4175-b765-a6f3a818e6ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "90dd17e5-f8aa-4f94-958f-9389bc58af26", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3d52530c-fe8b-4343-b42b-aa730f4b5848", + "value": "72131" + }, + { + "description": "Rooming and Boarding Houses, Dormitories, and Workers' Camps ", + "related": [ + { + "dest-uuid": "de6f1021-4cfc-4175-b765-a6f3a818e6ef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3d52530c-fe8b-4343-b42b-aa730f4b5848", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "90dd17e5-f8aa-4f94-958f-9389bc58af26", + "value": "721310" + }, + { + "description": "Food Services and Drinking Places", + "related": [ + { + "dest-uuid": "c98a0bfa-db3a-4b42-b2d9-6abc5f69ae4e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e18e3623-0537-476a-81fc-0967679a96e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "35b61fe8-2b04-4f69-b98d-a0299c74e7e3", + "value": "722" + }, + { + "description": "Special Food Services", + "related": [ + { + "dest-uuid": "35b61fe8-2b04-4f69-b98d-a0299c74e7e3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4586e78a-02f3-40f0-8703-f4eb9c6c9a36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b6269874-b8c0-41f4-9f31-38c871b4a0b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a57d6071-e62e-41bf-9840-ceea88ea9d2c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3c8656da-5865-46a8-9bfb-1c143140ba9a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c19dee18-b8ce-42a5-b1b0-49fe6b9bfe3a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "71ca7c16-41cf-4e41-81d4-0cd08e2feb9e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "value": "7223" + }, + { + "description": "Food Service Contractors", + "related": [ + { + "dest-uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b6269874-b8c0-41f4-9f31-38c871b4a0b4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4586e78a-02f3-40f0-8703-f4eb9c6c9a36", + "value": "72231" + }, + { + "description": "Food Service Contractors", + "related": [ + { + "dest-uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4586e78a-02f3-40f0-8703-f4eb9c6c9a36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b6269874-b8c0-41f4-9f31-38c871b4a0b4", + "value": "722310" + }, + { + "description": "Caterers", + "related": [ + { + "dest-uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3c8656da-5865-46a8-9bfb-1c143140ba9a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a57d6071-e62e-41bf-9840-ceea88ea9d2c", + "value": "72232" + }, + { + "description": "Caterers", + "related": [ + { + "dest-uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a57d6071-e62e-41bf-9840-ceea88ea9d2c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3c8656da-5865-46a8-9bfb-1c143140ba9a", + "value": "722320" + }, + { + "description": "Mobile Food Services", + "related": [ + { + "dest-uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "71ca7c16-41cf-4e41-81d4-0cd08e2feb9e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c19dee18-b8ce-42a5-b1b0-49fe6b9bfe3a", + "value": "72233" + }, + { + "description": "Mobile Food Services", + "related": [ + { + "dest-uuid": "8275595d-e6ce-4f80-b517-4c93bf641057", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c19dee18-b8ce-42a5-b1b0-49fe6b9bfe3a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "71ca7c16-41cf-4e41-81d4-0cd08e2feb9e", + "value": "722330" + }, + { + "description": "Drinking Places (Alcoholic Beverages)", + "related": [ + { + "dest-uuid": "35b61fe8-2b04-4f69-b98d-a0299c74e7e3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "411a7407-287e-4f85-8cca-d41b51d35ef4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d555143a-85fe-4261-b645-e07d2ae82c61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e18e3623-0537-476a-81fc-0967679a96e4", + "value": "7224" + }, + { + "description": "Drinking Places (Alcoholic Beverages)", + "related": [ + { + "dest-uuid": "e18e3623-0537-476a-81fc-0967679a96e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d555143a-85fe-4261-b645-e07d2ae82c61", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "411a7407-287e-4f85-8cca-d41b51d35ef4", + "value": "72241" + }, + { + "description": "Drinking Places (Alcoholic Beverages) ", + "related": [ + { + "dest-uuid": "e18e3623-0537-476a-81fc-0967679a96e4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "411a7407-287e-4f85-8cca-d41b51d35ef4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d555143a-85fe-4261-b645-e07d2ae82c61", + "value": "722410" + }, + { + "description": "Restaurants and Other Eating Places", + "related": [ + { + "dest-uuid": "35b61fe8-2b04-4f69-b98d-a0299c74e7e3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ec4763e0-8ca3-482e-ad56-7ab91f888968", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e23dc328-a1ec-4c8f-9ae3-4da47e523eb4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5b35fc02-550f-451a-9379-7d7164064530", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2a2059c3-41ab-42ba-9780-45bec90aca32", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "99c29a20-c63b-4f01-91b7-b5ba87679b73", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", + "value": "7225" + }, + { + "description": "Restaurants and Other Eating Places", + "related": [ + { + "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ec4763e0-8ca3-482e-ad56-7ab91f888968", + "value": "72251" + }, + { + "description": "Full-Service Restaurants ", + "related": [ + { + "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e23dc328-a1ec-4c8f-9ae3-4da47e523eb4", + "value": "722511" + }, + { + "description": "Limited-Service Restaurants ", + "related": [ + { + "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5b35fc02-550f-451a-9379-7d7164064530", + "value": "722513" + }, + { + "description": "Cafeterias, Grill Buffets, and Buffets ", + "related": [ + { + "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2a2059c3-41ab-42ba-9780-45bec90aca32", + "value": "722514" + }, + { + "description": "Snack and Nonalcoholic Beverage Bars ", + "related": [ + { + "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "99c29a20-c63b-4f01-91b7-b5ba87679b73", + "value": "722515" + }, + { + "description": "Other Services (except Public Administration)", + "related": [ + { + "dest-uuid": "2d17b384-2589-4155-a455-3b3319bb9075", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "354975ec-7d10-4563-8b18-f586f9b6d2f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "bf3470e5-e274-497a-ab76-b7bce8dcaa60", + "value": "81" + }, + { + "description": "Repair and Maintenance", + "related": [ + { + "dest-uuid": "bf3470e5-e274-497a-ab76-b7bce8dcaa60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9e375a04-53f2-4c26-b47a-2f14a38d0fc9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "25f5ede7-bf1d-4f02-acd6-424c994258c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "2d17b384-2589-4155-a455-3b3319bb9075", + "value": "811" + }, + { + "description": "Automotive Repair and Maintenance", + "related": [ + { + "dest-uuid": "2d17b384-2589-4155-a455-3b3319bb9075", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4a4c21b7-d29b-4748-9fcc-3ad3f7c29561", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a558e6de-b231-4c4c-b346-b3c8a1aeed28", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "af3f201c-84b2-45ce-9661-1adf69a701eb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "949b5db8-29c2-4e3c-ae82-11ca1ad808b6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c1fbfa93-063c-429d-8c27-f1fc65787aff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ed257389-2e39-4d45-86e7-d808163c6f56", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5b4931b4-2ea2-44c8-a8ae-953a34e36f19", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a603a9bd-706a-4cd2-8b6f-48ee6f9e7d9c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cc880eb3-29f2-4c60-b44c-2f99be7efd42", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f2bd21a3-b27b-4816-953d-37df6784d0ab", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "value": "8111" + }, + { + "description": "Automotive Mechanical and Electrical Repair and Maintenance", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "4a4c21b7-d29b-4748-9fcc-3ad3f7c29561", + "value": "81111" + }, + { + "description": "General Automotive Repair ", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a558e6de-b231-4c4c-b346-b3c8a1aeed28", + "value": "811111" + }, + { + "description": "Specialized Automotive Repair ", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "af3f201c-84b2-45ce-9661-1adf69a701eb", + "value": "811114" + }, + { + "description": "Automotive Body, Paint, Interior, and Glass Repair", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "949b5db8-29c2-4e3c-ae82-11ca1ad808b6", + "value": "81112" + }, + { + "description": "Automotive Body, Paint, and Interior Repair and Maintenance ", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "c1fbfa93-063c-429d-8c27-f1fc65787aff", + "value": "811121" + }, + { + "description": "Automotive Glass Replacement Shops ", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "ed257389-2e39-4d45-86e7-d808163c6f56", + "value": "811122" + }, + { + "description": "Other Automotive Repair and Maintenance", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "5b4931b4-2ea2-44c8-a8ae-953a34e36f19", + "value": "81119" + }, + { + "description": "Automotive Oil Change and Lubrication Shops ", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "a603a9bd-706a-4cd2-8b6f-48ee6f9e7d9c", + "value": "811191" + }, + { + "description": "Car Washes ", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "cc880eb3-29f2-4c60-b44c-2f99be7efd42", + "value": "811192" + }, + { + "description": "All Other Automotive Repair and Maintenance ", + "related": [ + { + "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f2bd21a3-b27b-4816-953d-37df6784d0ab", + "value": "811198" + }, + { + "description": "Electronic and Precision Equipment Repair and Maintenance", + "related": [ + { + "dest-uuid": "2d17b384-2589-4155-a455-3b3319bb9075", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b709ce41-3e1f-48e1-93eb-65506cf68bb9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3f232621-d65a-4fb3-837b-f2d9ffd79d93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "9e375a04-53f2-4c26-b47a-2f14a38d0fc9", + "value": "8112" + }, + { + "description": "Electronic and Precision Equipment Repair and Maintenance", + "related": [ + { + "dest-uuid": "9e375a04-53f2-4c26-b47a-2f14a38d0fc9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3f232621-d65a-4fb3-837b-f2d9ffd79d93", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b709ce41-3e1f-48e1-93eb-65506cf68bb9", + "value": "81121" + }, + { + "description": "Electronic and Precision Equipment Repair and Maintenance ", + "related": [ + { + "dest-uuid": "9e375a04-53f2-4c26-b47a-2f14a38d0fc9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b709ce41-3e1f-48e1-93eb-65506cf68bb9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3f232621-d65a-4fb3-837b-f2d9ffd79d93", + "value": "811210" + }, + { + "description": "Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance", + "related": [ + { + "dest-uuid": "2d17b384-2589-4155-a455-3b3319bb9075", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b731cba7-9884-4329-af47-10771f13071f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ad97692c-9b19-4c8f-a889-690935405e4b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "25f5ede7-bf1d-4f02-acd6-424c994258c5", + "value": "8113" + }, + { + "description": "Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance", + "related": [ + { + "dest-uuid": "25f5ede7-bf1d-4f02-acd6-424c994258c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ad97692c-9b19-4c8f-a889-690935405e4b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b731cba7-9884-4329-af47-10771f13071f", + "value": "81131" + }, + { + "description": "Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance ", + "related": [ + { + "dest-uuid": "25f5ede7-bf1d-4f02-acd6-424c994258c5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b731cba7-9884-4329-af47-10771f13071f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ad97692c-9b19-4c8f-a889-690935405e4b", + "value": "811310" + }, + { + "description": "Personal and Household Goods Repair and Maintenance", + "related": [ + { + "dest-uuid": "2d17b384-2589-4155-a455-3b3319bb9075", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d23a11b0-3ce1-4705-b850-2d75825cc9db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2ef211a4-fb94-4e12-82c5-2e3eb5f79499", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bb8d5267-e160-44b6-84f2-2b99cf49da95", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "16820882-9cb1-4535-af62-0d88cab73a24", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1e7dd717-047f-4124-9692-cd9409deab2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bda2d4c4-1b62-4445-bb1e-75b51728c717", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "be1bc8ce-9ef8-441c-abf6-16f6015e7a42", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "466d7a89-a002-41a4-80ad-edcb88638a3f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "41ce797f-c018-43e8-8560-4eca1783482f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "value": "8114" + }, + { + "description": "Home and Garden Equipment and Appliance Repair and Maintenance", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d23a11b0-3ce1-4705-b850-2d75825cc9db", + "value": "81141" + }, + { + "description": "Home and Garden Equipment Repair and Maintenance ", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2ef211a4-fb94-4e12-82c5-2e3eb5f79499", + "value": "811411" + }, + { + "description": "Appliance Repair and Maintenance ", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "bb8d5267-e160-44b6-84f2-2b99cf49da95", + "value": "811412" + }, + { + "description": "Reupholstery and Furniture Repair", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1e7dd717-047f-4124-9692-cd9409deab2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "16820882-9cb1-4535-af62-0d88cab73a24", + "value": "81142" + }, + { + "description": "Reupholstery and Furniture Repair", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "16820882-9cb1-4535-af62-0d88cab73a24", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1e7dd717-047f-4124-9692-cd9409deab2b", + "value": "811420" + }, + { + "description": "Footwear and Leather Goods Repair", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "be1bc8ce-9ef8-441c-abf6-16f6015e7a42", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bda2d4c4-1b62-4445-bb1e-75b51728c717", + "value": "81143" + }, + { + "description": "Footwear and Leather Goods Repair", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bda2d4c4-1b62-4445-bb1e-75b51728c717", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "be1bc8ce-9ef8-441c-abf6-16f6015e7a42", + "value": "811430" + }, + { + "description": "Other Personal and Household Goods Repair and Maintenance", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "41ce797f-c018-43e8-8560-4eca1783482f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "466d7a89-a002-41a4-80ad-edcb88638a3f", + "value": "81149" + }, + { + "description": "Other Personal and Household Goods Repair and Maintenance ", + "related": [ + { + "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "466d7a89-a002-41a4-80ad-edcb88638a3f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "41ce797f-c018-43e8-8560-4eca1783482f", + "value": "811490" + }, + { + "description": "Personal and Laundry Services", + "related": [ + { + "dest-uuid": "bf3470e5-e274-497a-ab76-b7bce8dcaa60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", + "value": "812" + }, + { + "description": "Personal Care Services ", + "related": [ + { + "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6875280b-af8d-4055-b10a-2585a4fb132f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f33adc27-0c9b-4d4e-bc5d-65bcce0b4468", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "95bec6de-36e4-41d2-b7bf-4c99827f6c36", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6b530166-56ea-48f1-a7c5-662b3d3fe8c6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f3072905-9cdf-4e26-aecc-82b876afe473", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dbeeeec6-c2b1-401d-b953-c41553c9f916", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "87fd9137-958a-439d-b2e4-968dc39d85af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "value": "8121" + }, + { + "description": "Hair, Nail, and Skin Care Services ", + "related": [ + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6875280b-af8d-4055-b10a-2585a4fb132f", + "value": "81211" + }, + { + "description": "Barber Shops ", + "related": [ + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f33adc27-0c9b-4d4e-bc5d-65bcce0b4468", + "value": "812111" + }, + { + "description": "Beauty Salons ", + "related": [ + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "95bec6de-36e4-41d2-b7bf-4c99827f6c36", + "value": "812112" + }, + { + "description": "Nail Salons ", + "related": [ + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "6b530166-56ea-48f1-a7c5-662b3d3fe8c6", + "value": "812113" + }, + { + "description": "Other Personal Care Services ", + "related": [ + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "f3072905-9cdf-4e26-aecc-82b876afe473", + "value": "81219" + }, + { + "description": "Diet and Weight Reducing Centers ", + "related": [ + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "dbeeeec6-c2b1-401d-b953-c41553c9f916", + "value": "812191" + }, + { + "description": "Other Personal Care Services ", + "related": [ + { + "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "87fd9137-958a-439d-b2e4-968dc39d85af", + "value": "812199" + }, + { + "description": "Death Care Services ", + "related": [ + { + "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "29e291bd-6f01-49c4-87be-ed869d5ad563", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b3c3c15f-f955-45bf-af89-ae1fd9f0c63f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cfb4ce66-54c0-40fb-ac54-072e6b9ad68b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "198e0192-1971-49c0-80db-35dee7730eff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", + "value": "8122" + }, + { + "description": "Funeral Homes and Funeral Services ", + "related": [ + { + "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b3c3c15f-f955-45bf-af89-ae1fd9f0c63f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "29e291bd-6f01-49c4-87be-ed869d5ad563", + "value": "81221" + }, + { + "description": "Funeral Homes and Funeral Services ", + "related": [ + { + "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "29e291bd-6f01-49c4-87be-ed869d5ad563", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b3c3c15f-f955-45bf-af89-ae1fd9f0c63f", + "value": "812210" + }, + { + "description": "Cemeteries and Crematories ", + "related": [ + { + "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "198e0192-1971-49c0-80db-35dee7730eff", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cfb4ce66-54c0-40fb-ac54-072e6b9ad68b", + "value": "81222" + }, + { + "description": "Cemeteries and Crematories ", + "related": [ + { + "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cfb4ce66-54c0-40fb-ac54-072e6b9ad68b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "198e0192-1971-49c0-80db-35dee7730eff", + "value": "812220" + }, + { + "description": "Drycleaning and Laundry Services ", + "related": [ + { + "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "382ee221-58ba-44b6-9d0e-9db6f88dd43a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8acc8c22-1e8e-4f97-85cb-d11804d21787", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6767214a-c233-44c9-bcb6-685d7f6bee89", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "da28b4c5-b5aa-4da0-b3c6-53a285fda435", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3d85b77c-7512-4ad0-8309-d47cac772957", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "11d17fbc-565f-44b7-995f-cf62f5168f5a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1f5ecd1b-5d9f-49b2-aee0-208892d083b7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "value": "8123" + }, + { + "description": "Coin-Operated Laundries and Drycleaners ", + "related": [ + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8acc8c22-1e8e-4f97-85cb-d11804d21787", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "382ee221-58ba-44b6-9d0e-9db6f88dd43a", + "value": "81231" + }, + { + "description": "Coin-Operated Laundries and Drycleaners ", + "related": [ + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "382ee221-58ba-44b6-9d0e-9db6f88dd43a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8acc8c22-1e8e-4f97-85cb-d11804d21787", + "value": "812310" + }, + { + "description": "Drycleaning and Laundry Services (except Coin-Operated) ", + "related": [ + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "da28b4c5-b5aa-4da0-b3c6-53a285fda435", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6767214a-c233-44c9-bcb6-685d7f6bee89", + "value": "81232" + }, + { + "description": "Drycleaning and Laundry Services (except Coin-Operated) ", + "related": [ + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6767214a-c233-44c9-bcb6-685d7f6bee89", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "da28b4c5-b5aa-4da0-b3c6-53a285fda435", + "value": "812320" + }, + { + "description": "Linen and Uniform Supply ", + "related": [ + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3d85b77c-7512-4ad0-8309-d47cac772957", + "value": "81233" + }, + { + "description": "Linen Supply ", + "related": [ + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "11d17fbc-565f-44b7-995f-cf62f5168f5a", + "value": "812331" + }, + { + "description": "Industrial Launderers ", + "related": [ + { + "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "1f5ecd1b-5d9f-49b2-aee0-208892d083b7", + "value": "812332" + }, + { + "description": "Other Personal Services ", + "related": [ + { + "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d5e99a99-3a08-4660-aa30-45c1a80db13f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "82e4cbd8-0fdc-4ca2-89c2-604eb698be02", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2792af23-7a24-43c6-bd51-659267083fa2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "04533c17-d3fc-4a8e-bf96-7ea925bab739", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d9f4cce8-7cae-4f0e-9fed-3cbd84d2e717", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3dd1a64e-53bf-4d9e-ae11-c6778682e472", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "df516e2c-9cc2-492f-994a-e0f4f459b4f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9311a149-d1ef-406d-9ef1-0df2cfdf40db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "003a6da8-ef62-4d1c-9c85-018415ab3426", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "value": "8129" + }, + { + "description": "Pet Care (except Veterinary) Services ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "82e4cbd8-0fdc-4ca2-89c2-604eb698be02", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d5e99a99-3a08-4660-aa30-45c1a80db13f", + "value": "81291" + }, + { + "description": "Pet Care (except Veterinary) Services ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d5e99a99-3a08-4660-aa30-45c1a80db13f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "82e4cbd8-0fdc-4ca2-89c2-604eb698be02", + "value": "812910" + }, + { + "description": "Photofinishing ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2792af23-7a24-43c6-bd51-659267083fa2", + "value": "81292" + }, + { + "description": "Photofinishing Laboratories (except One-Hour) ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "04533c17-d3fc-4a8e-bf96-7ea925bab739", + "value": "812921" + }, + { + "description": "One-Hour Photofinishing ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "d9f4cce8-7cae-4f0e-9fed-3cbd84d2e717", + "value": "812922" + }, + { + "description": "Parking Lots and Garages ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "df516e2c-9cc2-492f-994a-e0f4f459b4f7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3dd1a64e-53bf-4d9e-ae11-c6778682e472", + "value": "81293" + }, + { + "description": "Parking Lots and Garages ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3dd1a64e-53bf-4d9e-ae11-c6778682e472", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "df516e2c-9cc2-492f-994a-e0f4f459b4f7", + "value": "812930" + }, + { + "description": "All Other Personal Services ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "003a6da8-ef62-4d1c-9c85-018415ab3426", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9311a149-d1ef-406d-9ef1-0df2cfdf40db", + "value": "81299" + }, + { + "description": "All Other Personal Services ", + "related": [ + { + "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9311a149-d1ef-406d-9ef1-0df2cfdf40db", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "003a6da8-ef62-4d1c-9c85-018415ab3426", + "value": "812990" + }, + { + "description": "Religious, Grantmaking, Civic, Professional, and Similar Organizations", + "related": [ + { + "dest-uuid": "bf3470e5-e274-497a-ab76-b7bce8dcaa60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "be333773-d086-4e27-b5ed-af3220bca134", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8d95a395-059d-4ef2-9344-c54662166207", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", + "value": "813" + }, + { + "description": "Religious Organizations ", + "related": [ + { + "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6adf2e02-1505-45b3-b80b-83449c1b866a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "638fc1a4-e0f6-4730-8ea6-75b5aa05f5bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "be333773-d086-4e27-b5ed-af3220bca134", + "value": "8131" + }, + { + "description": "Religious Organizations ", + "related": [ + { + "dest-uuid": "be333773-d086-4e27-b5ed-af3220bca134", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "638fc1a4-e0f6-4730-8ea6-75b5aa05f5bb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6adf2e02-1505-45b3-b80b-83449c1b866a", + "value": "81311" + }, + { + "description": "Religious Organizations ", + "related": [ + { + "dest-uuid": "be333773-d086-4e27-b5ed-af3220bca134", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6adf2e02-1505-45b3-b80b-83449c1b866a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "638fc1a4-e0f6-4730-8ea6-75b5aa05f5bb", + "value": "813110" + }, + { + "description": "Grantmaking and Giving Services ", + "related": [ + { + "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2d34c873-30da-45fc-a0a9-74877d3e9c8c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e70e3a7b-9add-41e2-9b7f-39b192d097f3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "23d4bba7-dbb9-4377-9abb-844f50fb2426", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "766dab09-5d30-4599-abc1-f7092d60b53e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", + "value": "8132" + }, + { + "description": "Grantmaking and Giving Services ", + "related": [ + { + "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "2d34c873-30da-45fc-a0a9-74877d3e9c8c", + "value": "81321" + }, + { + "description": "Grantmaking Foundations ", + "related": [ + { + "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "e70e3a7b-9add-41e2-9b7f-39b192d097f3", + "value": "813211" + }, + { + "description": "Voluntary Health Organizations ", + "related": [ + { + "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "23d4bba7-dbb9-4377-9abb-844f50fb2426", + "value": "813212" + }, + { + "description": "Other Grantmaking and Giving Services ", + "related": [ + { + "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "766dab09-5d30-4599-abc1-f7092d60b53e", + "value": "813219" + }, + { + "description": "Social Advocacy Organizations ", + "related": [ + { + "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b675907b-364c-4fe3-b34b-82bea364efd7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8ff0e683-cf68-41f3-a61c-3f54ec115fd8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3025e7f8-a45a-44ea-a85b-eeea2300fdaf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "27d51e6b-a234-47b6-bc34-67aad788702f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "679d5980-5809-4226-8980-89a57ce70cdf", + "value": "8133" + }, + { + "description": "Social Advocacy Organizations ", + "related": [ + { + "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "b675907b-364c-4fe3-b34b-82bea364efd7", + "value": "81331" + }, + { + "description": "Human Rights Organizations ", + "related": [ + { + "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "8ff0e683-cf68-41f3-a61c-3f54ec115fd8", + "value": "813311" + }, + { + "description": "Environment, Conservation and Wildlife Organizations ", + "related": [ + { + "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "3025e7f8-a45a-44ea-a85b-eeea2300fdaf", + "value": "813312" + }, + { + "description": "Other Social Advocacy Organizations ", + "related": [ + { + "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + } + ], + "uuid": "27d51e6b-a234-47b6-bc34-67aad788702f", + "value": "813319" + }, + { + "description": "Civic and Social Organizations ", + "related": [ + { + "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d67f5878-9315-48b9-bff1-a8fcedf17f2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bb096c32-ae40-47cb-9a34-b562deafe869", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8d95a395-059d-4ef2-9344-c54662166207", + "value": "8134" + }, + { + "description": "Civic and Social Organizations ", + "related": [ + { + "dest-uuid": "8d95a395-059d-4ef2-9344-c54662166207", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bb096c32-ae40-47cb-9a34-b562deafe869", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d67f5878-9315-48b9-bff1-a8fcedf17f2b", + "value": "81341" + }, + { + "description": "Civic and Social Organizations ", + "related": [ + { + "dest-uuid": "8d95a395-059d-4ef2-9344-c54662166207", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d67f5878-9315-48b9-bff1-a8fcedf17f2b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bb096c32-ae40-47cb-9a34-b562deafe869", + "value": "813410" + }, + { + "description": "Business, Professional, Labor, Political, and Similar Organizations ", + "related": [ + { + "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4d57a710-5cce-4033-b0e9-f03f3e41a5a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5d80f00c-cd19-4be9-b991-5d87358ce1dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "86bce152-eadb-4a16-8190-9eff17dd0926", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d6ac59b0-24dc-431b-8729-7a3a0b652a2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "050916cd-a580-4059-8e0a-42a0ecc31460", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ccbfc856-29ef-4a0c-bace-6b4ba4404429", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8f4e63ec-5012-4562-81ac-e0d8564b4c44", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5c216250-ca22-4d68-ad24-19c3912325de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "2d1407ca-81b4-454d-b1d4-75e50b460864", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e4cc2f3d-4b62-48d5-a48e-da66b19f7819", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "value": "8139" + }, + { + "description": "Business Associations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5d80f00c-cd19-4be9-b991-5d87358ce1dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4d57a710-5cce-4033-b0e9-f03f3e41a5a0", + "value": "81391" + }, + { + "description": "Business Associations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4d57a710-5cce-4033-b0e9-f03f3e41a5a0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5d80f00c-cd19-4be9-b991-5d87358ce1dc", + "value": "813910" + }, + { + "description": "Professional Organizations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d6ac59b0-24dc-431b-8729-7a3a0b652a2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "86bce152-eadb-4a16-8190-9eff17dd0926", + "value": "81392" + }, + { + "description": "Professional Organizations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "86bce152-eadb-4a16-8190-9eff17dd0926", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d6ac59b0-24dc-431b-8729-7a3a0b652a2a", + "value": "813920" + }, + { + "description": "Labor Unions and Similar Labor Organizations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ccbfc856-29ef-4a0c-bace-6b4ba4404429", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "050916cd-a580-4059-8e0a-42a0ecc31460", + "value": "81393" + }, + { + "description": "Labor Unions and Similar Labor Organizations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "050916cd-a580-4059-8e0a-42a0ecc31460", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ccbfc856-29ef-4a0c-bace-6b4ba4404429", + "value": "813930" + }, + { + "description": "Political Organizations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5c216250-ca22-4d68-ad24-19c3912325de", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8f4e63ec-5012-4562-81ac-e0d8564b4c44", + "value": "81394" + }, + { + "description": "Political Organizations ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8f4e63ec-5012-4562-81ac-e0d8564b4c44", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5c216250-ca22-4d68-ad24-19c3912325de", + "value": "813940" + }, + { + "description": "Other Similar Organizations (except Business, Professional, Labor, and Political Organizations) ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e4cc2f3d-4b62-48d5-a48e-da66b19f7819", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "2d1407ca-81b4-454d-b1d4-75e50b460864", + "value": "81399" + }, + { + "description": "Other Similar Organizations (except Business, Professional, Labor, and Political Organizations) ", + "related": [ + { + "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "2d1407ca-81b4-454d-b1d4-75e50b460864", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e4cc2f3d-4b62-48d5-a48e-da66b19f7819", + "value": "813990" + }, + { + "description": "Private Households", + "related": [ + { + "dest-uuid": "bf3470e5-e274-497a-ab76-b7bce8dcaa60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3b574c3a-73d2-42f7-8091-cb8edb90bd27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "354975ec-7d10-4563-8b18-f586f9b6d2f4", + "value": "814" + }, + { + "description": "Private Households", + "related": [ + { + "dest-uuid": "354975ec-7d10-4563-8b18-f586f9b6d2f4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0c6ae1ee-1636-4e42-afb8-56fd27177f1e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ad0209de-3ea6-4f14-b700-b1fae8b97c64", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "3b574c3a-73d2-42f7-8091-cb8edb90bd27", + "value": "8141" + }, + { + "description": "Private Households", + "related": [ + { + "dest-uuid": "3b574c3a-73d2-42f7-8091-cb8edb90bd27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ad0209de-3ea6-4f14-b700-b1fae8b97c64", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0c6ae1ee-1636-4e42-afb8-56fd27177f1e", + "value": "81411" + }, + { + "description": "Private Households", + "related": [ + { + "dest-uuid": "3b574c3a-73d2-42f7-8091-cb8edb90bd27", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0c6ae1ee-1636-4e42-afb8-56fd27177f1e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ad0209de-3ea6-4f14-b700-b1fae8b97c64", + "value": "814110" + }, + { + "description": "Public Administration", + "related": [ + { + "dest-uuid": "8c336a3c-bd15-48d8-baf4-3b320c5da96b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cbc86963-622b-4754-943d-4889c52024e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ab992529-7c7b-453b-871e-2f823242fda4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4b8b200a-1cf1-4ea6-a751-6020730980f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6e0eb260-7cef-4720-bdc0-3e4e588d1a2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dfbe5f1e-c71c-4dee-898e-d6052949e1e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f0560215-6aad-44fa-94ef-443d5cb3d2e2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "29dc02b0-0ecf-42e5-a8ff-8d4015bea751", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "value": "92" + }, + { + "description": "Executive, Legislative, and Other General Government Support ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8c336a3c-bd15-48d8-baf4-3b320c5da96b", + "value": "921" + }, + { + "description": "Executive, Legislative, and Other General Government Support ", + "related": [ + { + "dest-uuid": "8c336a3c-bd15-48d8-baf4-3b320c5da96b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d22ea8e9-7a5c-4cbd-a23d-518fee4d27dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4bb8d180-ed58-48ea-aad3-46e87288315d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "4323d037-7839-4112-9ee9-8a68c365cd99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6f6a1617-8aa6-443e-baa8-cd487679bd18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5e2a4d1f-5e1d-4b85-9859-ed12b4c0d208", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ca749d83-1270-43f7-8b4c-ed40d16dcff3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a04ea115-9e4b-4b9c-99e8-ffa8f120a75b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "0e29a412-ff7e-41f8-8ca9-75d18d299c3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "d497c3dd-5132-4e3a-8ff5-91739a02346c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f82635aa-dd87-4618-90f5-fd4efe7b40d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "53dcb70b-5b11-4018-8c6c-6144ea317062", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7b9a59f9-f481-40ec-ac38-81f60bfdc87c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "value": "9211" + }, + { + "description": "Executive Offices ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4bb8d180-ed58-48ea-aad3-46e87288315d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d22ea8e9-7a5c-4cbd-a23d-518fee4d27dc", + "value": "92111" + }, + { + "description": "Executive Offices ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d22ea8e9-7a5c-4cbd-a23d-518fee4d27dc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4bb8d180-ed58-48ea-aad3-46e87288315d", + "value": "921110" + }, + { + "description": "Legislative Bodies ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6f6a1617-8aa6-443e-baa8-cd487679bd18", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "4323d037-7839-4112-9ee9-8a68c365cd99", + "value": "92112" + }, + { + "description": "Legislative Bodies ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "4323d037-7839-4112-9ee9-8a68c365cd99", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6f6a1617-8aa6-443e-baa8-cd487679bd18", + "value": "921120" + }, + { + "description": "Public Finance Activities ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ca749d83-1270-43f7-8b4c-ed40d16dcff3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5e2a4d1f-5e1d-4b85-9859-ed12b4c0d208", + "value": "92113" + }, + { + "description": "Public Finance Activities ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5e2a4d1f-5e1d-4b85-9859-ed12b4c0d208", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ca749d83-1270-43f7-8b4c-ed40d16dcff3", + "value": "921130" + }, + { + "description": "Executive and Legislative Offices, Combined ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "0e29a412-ff7e-41f8-8ca9-75d18d299c3d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a04ea115-9e4b-4b9c-99e8-ffa8f120a75b", + "value": "92114" + }, + { + "description": "Executive and Legislative Offices, Combined ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a04ea115-9e4b-4b9c-99e8-ffa8f120a75b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "0e29a412-ff7e-41f8-8ca9-75d18d299c3d", + "value": "921140" + }, + { + "description": "American Indian and Alaska Native Tribal Governments ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f82635aa-dd87-4618-90f5-fd4efe7b40d5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d497c3dd-5132-4e3a-8ff5-91739a02346c", + "value": "92115" + }, + { + "description": "American Indian and Alaska Native Tribal Governments ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d497c3dd-5132-4e3a-8ff5-91739a02346c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f82635aa-dd87-4618-90f5-fd4efe7b40d5", + "value": "921150" + }, + { + "description": "Other General Government Support ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7b9a59f9-f481-40ec-ac38-81f60bfdc87c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "53dcb70b-5b11-4018-8c6c-6144ea317062", + "value": "92119" + }, + { + "description": "Other General Government Support ", + "related": [ + { + "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "53dcb70b-5b11-4018-8c6c-6144ea317062", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7b9a59f9-f481-40ec-ac38-81f60bfdc87c", + "value": "921190" + }, + { + "description": "Justice, Public Order, and Safety Activities ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cbc86963-622b-4754-943d-4889c52024e9", + "value": "922" + }, + { + "description": "Justice, Public Order, and Safety Activities ", + "related": [ + { + "dest-uuid": "cbc86963-622b-4754-943d-4889c52024e9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fa534ace-b263-435a-9656-11d15cdf8ed5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "1998adc8-62b0-4cfd-84ca-98acd744a25e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "45bbe046-f826-47a8-8716-bf964c6b961b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "70792a8f-9dd8-4fcf-93da-2fab953765cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "49feb15b-b164-4633-829f-3b77cd8e5a5f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a32cd93e-86ed-4b1e-8220-e1e9460eb672", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "37d1175a-b952-4959-8152-aa5f90e8bfa6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "39cc3f22-fc90-487b-8001-31b76c12f251", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "dbfdd1db-411c-43e1-aeb7-25520f23f3b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "ce7ef311-867b-426e-b0ac-c706af4ecc91", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "362d78ae-0e0e-49d6-801b-b62e24bb258a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e7ffe196-e318-434a-82e5-2c2b428aab0a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e78518ce-0357-48a9-a380-189f22d34594", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "49689431-e9ab-4df1-b446-b512462c2267", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "value": "9221" + }, + { + "description": "Courts ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1998adc8-62b0-4cfd-84ca-98acd744a25e", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fa534ace-b263-435a-9656-11d15cdf8ed5", + "value": "92211" + }, + { + "description": "Courts ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fa534ace-b263-435a-9656-11d15cdf8ed5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1998adc8-62b0-4cfd-84ca-98acd744a25e", + "value": "922110" + }, + { + "description": "Police Protection ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "70792a8f-9dd8-4fcf-93da-2fab953765cc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "45bbe046-f826-47a8-8716-bf964c6b961b", + "value": "92212" + }, + { + "description": "Police Protection ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "45bbe046-f826-47a8-8716-bf964c6b961b", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "70792a8f-9dd8-4fcf-93da-2fab953765cc", + "value": "922120" + }, + { + "description": "Legal Counsel and Prosecution ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a32cd93e-86ed-4b1e-8220-e1e9460eb672", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "49feb15b-b164-4633-829f-3b77cd8e5a5f", + "value": "92213" + }, + { + "description": "Legal Counsel and Prosecution ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "49feb15b-b164-4633-829f-3b77cd8e5a5f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a32cd93e-86ed-4b1e-8220-e1e9460eb672", + "value": "922130" + }, + { + "description": "Correctional Institutions ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "39cc3f22-fc90-487b-8001-31b76c12f251", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "37d1175a-b952-4959-8152-aa5f90e8bfa6", + "value": "92214" + }, + { + "description": "Correctional Institutions ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "37d1175a-b952-4959-8152-aa5f90e8bfa6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "39cc3f22-fc90-487b-8001-31b76c12f251", + "value": "922140" + }, + { + "description": "Parole Offices and Probation Offices ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "ce7ef311-867b-426e-b0ac-c706af4ecc91", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "dbfdd1db-411c-43e1-aeb7-25520f23f3b3", + "value": "92215" + }, + { + "description": "Parole Offices and Probation Offices ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "dbfdd1db-411c-43e1-aeb7-25520f23f3b3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "ce7ef311-867b-426e-b0ac-c706af4ecc91", + "value": "922150" + }, + { + "description": "Fire Protection ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e7ffe196-e318-434a-82e5-2c2b428aab0a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "362d78ae-0e0e-49d6-801b-b62e24bb258a", + "value": "92216" + }, + { + "description": "Fire Protection ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "362d78ae-0e0e-49d6-801b-b62e24bb258a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e7ffe196-e318-434a-82e5-2c2b428aab0a", + "value": "922160" + }, + { + "description": "Other Justice, Public Order, and Safety Activities ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "49689431-e9ab-4df1-b446-b512462c2267", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e78518ce-0357-48a9-a380-189f22d34594", + "value": "92219" + }, + { + "description": "Other Justice, Public Order, and Safety Activities ", + "related": [ + { + "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e78518ce-0357-48a9-a380-189f22d34594", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "49689431-e9ab-4df1-b446-b512462c2267", + "value": "922190" + }, + { + "description": "Administration of Human Resource Programs ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "ab992529-7c7b-453b-871e-2f823242fda4", + "value": "923" + }, + { + "description": "Administration of Human Resource Programs ", + "related": [ + { + "dest-uuid": "ab992529-7c7b-453b-871e-2f823242fda4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd73e522-49cb-452c-ac66-a6422449de58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f37ec8ab-c982-4519-a6d7-e0e241269b88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7d693e4f-b2c4-4160-bc29-2e958eb7e593", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "407a3861-0885-4338-8320-057b5f83d333", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "cab6bdf8-9950-458d-bd0e-f84169f4cb60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "630c7ad5-a483-437c-8a57-5352376bcf32", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "3a5f8d1b-01ba-4fea-8b04-f02e4a765ad9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "c38e512b-10ab-4f6d-a9af-40a37c5c3df7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "value": "9231" + }, + { + "description": "Administration of Education Programs ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f37ec8ab-c982-4519-a6d7-e0e241269b88", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "fd73e522-49cb-452c-ac66-a6422449de58", + "value": "92311" + }, + { + "description": "Administration of Education Programs ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "fd73e522-49cb-452c-ac66-a6422449de58", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f37ec8ab-c982-4519-a6d7-e0e241269b88", + "value": "923110" + }, + { + "description": "Administration of Public Health Programs ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "407a3861-0885-4338-8320-057b5f83d333", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7d693e4f-b2c4-4160-bc29-2e958eb7e593", + "value": "92312" + }, + { + "description": "Administration of Public Health Programs ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7d693e4f-b2c4-4160-bc29-2e958eb7e593", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "407a3861-0885-4338-8320-057b5f83d333", + "value": "923120" + }, + { + "description": "Administration of Human Resource Programs (except Education, Public Health, and Veterans' Affairs Programs) ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "630c7ad5-a483-437c-8a57-5352376bcf32", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "cab6bdf8-9950-458d-bd0e-f84169f4cb60", + "value": "92313" + }, + { + "description": "Administration of Human Resource Programs (except Education, Public Health, and Veterans' Affairs Programs) ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cab6bdf8-9950-458d-bd0e-f84169f4cb60", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "630c7ad5-a483-437c-8a57-5352376bcf32", + "value": "923130" + }, + { + "description": "Administration of Veterans' Affairs ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c38e512b-10ab-4f6d-a9af-40a37c5c3df7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "3a5f8d1b-01ba-4fea-8b04-f02e4a765ad9", + "value": "92314" + }, + { + "description": "Administration of Veterans' Affairs ", + "related": [ + { + "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "3a5f8d1b-01ba-4fea-8b04-f02e4a765ad9", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c38e512b-10ab-4f6d-a9af-40a37c5c3df7", + "value": "923140" + }, + { + "description": "Administration of Environmental Quality Programs ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "4b8b200a-1cf1-4ea6-a751-6020730980f6", + "value": "924" + }, + { + "description": "Administration of Environmental Quality Programs ", + "related": [ + { + "dest-uuid": "4b8b200a-1cf1-4ea6-a751-6020730980f6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d77d3595-39f1-4e84-a467-8770ecb9e5fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a1d0d9e7-9140-4568-b568-e724bfd4fdef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "88dbec7c-148b-4c6a-ba63-71882399eaa1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "6d7cba26-3ca7-4b3f-8de6-548c9863e6fb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", + "value": "9241" + }, + { + "description": "Administration of Air and Water Resource and Solid Waste Management Programs ", + "related": [ + { + "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a1d0d9e7-9140-4568-b568-e724bfd4fdef", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "d77d3595-39f1-4e84-a467-8770ecb9e5fc", + "value": "92411" + }, + { + "description": "Administration of Air and Water Resource and Solid Waste Management Programs ", + "related": [ + { + "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "d77d3595-39f1-4e84-a467-8770ecb9e5fc", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a1d0d9e7-9140-4568-b568-e724bfd4fdef", + "value": "924110" + }, + { + "description": "Administration of Conservation Programs ", + "related": [ + { + "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "6d7cba26-3ca7-4b3f-8de6-548c9863e6fb", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "88dbec7c-148b-4c6a-ba63-71882399eaa1", + "value": "92412" + }, + { + "description": "Administration of Conservation Programs ", + "related": [ + { + "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "88dbec7c-148b-4c6a-ba63-71882399eaa1", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "6d7cba26-3ca7-4b3f-8de6-548c9863e6fb", + "value": "924120" + }, + { + "description": "Administration of Housing Programs, Urban Planning, and Community Development ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "6e0eb260-7cef-4720-bdc0-3e4e588d1a2d", + "value": "925" + }, + { + "description": "Administration of Housing Programs, Urban Planning, and Community Development ", + "related": [ + { + "dest-uuid": "6e0eb260-7cef-4720-bdc0-3e4e588d1a2d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1fb1e45e-51ef-4706-acd3-02d7ba1f71f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "f4492ebc-5c10-4ad3-a9d8-886e553a9dda", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5491fb12-acfa-4674-87e6-050f7fa7cc24", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "83f72876-c4d9-4aef-8d3a-ab08e6cc27ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", + "value": "9251" + }, + { + "description": "Administration of Housing Programs ", + "related": [ + { + "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "f4492ebc-5c10-4ad3-a9d8-886e553a9dda", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "1fb1e45e-51ef-4706-acd3-02d7ba1f71f5", + "value": "92511" + }, + { + "description": "Administration of Housing Programs ", + "related": [ + { + "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "1fb1e45e-51ef-4706-acd3-02d7ba1f71f5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "f4492ebc-5c10-4ad3-a9d8-886e553a9dda", + "value": "925110" + }, + { + "description": "Administration of Urban Planning and Community and Rural Development ", + "related": [ + { + "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "83f72876-c4d9-4aef-8d3a-ab08e6cc27ed", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5491fb12-acfa-4674-87e6-050f7fa7cc24", + "value": "92512" + }, + { + "description": "Administration of Urban Planning and Community and Rural Development ", + "related": [ + { + "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5491fb12-acfa-4674-87e6-050f7fa7cc24", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "83f72876-c4d9-4aef-8d3a-ab08e6cc27ed", + "value": "925120" + }, + { + "description": "Administration of Economic Programs ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "dfbe5f1e-c71c-4dee-898e-d6052949e1e5", + "value": "926" + }, + { + "description": "Administration of Economic Programs ", + "related": [ + { + "dest-uuid": "dfbe5f1e-c71c-4dee-898e-d6052949e1e5", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "59a2c417-3aaf-449c-b613-90115976cac6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bd412293-f6ee-439d-a0ef-46ddb2049710", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "a8c77e7e-2a10-4efd-82b1-5d802ad9a969", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "9c76d5be-c3cd-4072-bf98-b5bdb3a78a97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "5904e89d-da73-4ef3-b19f-7182c1f3bfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "52b22c14-60ce-475e-a4f9-b0d1037569d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "8fa16aeb-f2a3-4940-b0e6-3716e0e50893", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "b1d307cc-bf55-488b-b33f-cb086d52d662", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "27cc468a-5660-4cef-a3cf-3f42c1bd931c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "e08767c9-ff80-4ebc-b23d-891edcd35a49", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "value": "9261" + }, + { + "description": "Administration of General Economic Programs ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bd412293-f6ee-439d-a0ef-46ddb2049710", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "59a2c417-3aaf-449c-b613-90115976cac6", + "value": "92611" + }, + { + "description": "Administration of General Economic Programs ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "59a2c417-3aaf-449c-b613-90115976cac6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bd412293-f6ee-439d-a0ef-46ddb2049710", + "value": "926110" + }, + { + "description": "Regulation and Administration of Transportation Programs ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "9c76d5be-c3cd-4072-bf98-b5bdb3a78a97", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "a8c77e7e-2a10-4efd-82b1-5d802ad9a969", + "value": "92612" + }, + { + "description": "Regulation and Administration of Transportation Programs ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "a8c77e7e-2a10-4efd-82b1-5d802ad9a969", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "9c76d5be-c3cd-4072-bf98-b5bdb3a78a97", + "value": "926120" + }, + { + "description": "Regulation and Administration of Communications, Electric, Gas, and Other Utilities ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "52b22c14-60ce-475e-a4f9-b0d1037569d3", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "5904e89d-da73-4ef3-b19f-7182c1f3bfd6", + "value": "92613" + }, + { + "description": "Regulation and Administration of Communications, Electric, Gas, and Other Utilities ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "5904e89d-da73-4ef3-b19f-7182c1f3bfd6", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "52b22c14-60ce-475e-a4f9-b0d1037569d3", + "value": "926130" + }, + { + "description": "Regulation of Agricultural Marketing and Commodities ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "b1d307cc-bf55-488b-b33f-cb086d52d662", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "8fa16aeb-f2a3-4940-b0e6-3716e0e50893", + "value": "92614" + }, + { + "description": "Regulation of Agricultural Marketing and Commodities ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "8fa16aeb-f2a3-4940-b0e6-3716e0e50893", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "b1d307cc-bf55-488b-b33f-cb086d52d662", + "value": "926140" + }, + { + "description": "Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "e08767c9-ff80-4ebc-b23d-891edcd35a49", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "27cc468a-5660-4cef-a3cf-3f42c1bd931c", + "value": "92615" + }, + { + "description": "Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors ", + "related": [ + { + "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "27cc468a-5660-4cef-a3cf-3f42c1bd931c", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "e08767c9-ff80-4ebc-b23d-891edcd35a49", + "value": "926150" + }, + { + "description": "Space Research and Technology ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "561dd159-0dfb-4a54-b7e8-489dce89645f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "f0560215-6aad-44fa-94ef-443d5cb3d2e2", + "value": "927" + }, + { + "description": "Space Research and Technology ", + "related": [ + { + "dest-uuid": "f0560215-6aad-44fa-94ef-443d5cb3d2e2", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c786ccd2-8496-4a9a-a5dc-4830f8b5f652", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "7fce53e8-6d4b-496e-b36f-2a36613347d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "561dd159-0dfb-4a54-b7e8-489dce89645f", + "value": "9271" + }, + { + "description": "Space Research and Technology ", + "related": [ + { + "dest-uuid": "561dd159-0dfb-4a54-b7e8-489dce89645f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "7fce53e8-6d4b-496e-b36f-2a36613347d4", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "c786ccd2-8496-4a9a-a5dc-4830f8b5f652", + "value": "92711" + }, + { + "description": "Space Research and Technology ", + "related": [ + { + "dest-uuid": "561dd159-0dfb-4a54-b7e8-489dce89645f", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "c786ccd2-8496-4a9a-a5dc-4830f8b5f652", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "7fce53e8-6d4b-496e-b36f-2a36613347d4", + "value": "927110" + }, + { + "description": "National Security and International Affairs ", + "related": [ + { + "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "29dc02b0-0ecf-42e5-a8ff-8d4015bea751", + "value": "928" + }, + { + "description": "National Security and International Affairs ", + "related": [ + { + "dest-uuid": "29dc02b0-0ecf-42e5-a8ff-8d4015bea751", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "45a94354-b620-42c5-92d7-18a56cbb3e9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "96d73b5d-0590-44f1-803b-78117f616e2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "bd5f1787-e382-4314-88a4-97b4a0371ee8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + }, + { + "dest-uuid": "978ee22b-4783-4393-b218-3c0785b9bb75", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "parent-of" + } + ], + "uuid": "433d2887-752b-43dd-a7a1-263e26abb291", + "value": "9281" + }, + { + "description": "National Security ", + "related": [ + { + "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "96d73b5d-0590-44f1-803b-78117f616e2a", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "45a94354-b620-42c5-92d7-18a56cbb3e9d", + "value": "92811" + }, + { + "description": "National Security ", + "related": [ + { + "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "45a94354-b620-42c5-92d7-18a56cbb3e9d", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "96d73b5d-0590-44f1-803b-78117f616e2a", + "value": "928110" + }, + { + "description": "International Affairs ", + "related": [ + { + "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "978ee22b-4783-4393-b218-3c0785b9bb75", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "bd5f1787-e382-4314-88a4-97b4a0371ee8", + "value": "92812" + }, + { + "description": "International Affairs ", + "related": [ + { + "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "child-of" + }, + { + "dest-uuid": "bd5f1787-e382-4314-88a4-97b4a0371ee8", + "tags": [ + "estimative-language:likelihood-probability=\"likely\"" + ], + "type": "similar" + } + ], + "uuid": "978ee22b-4783-4393-b218-3c0785b9bb75", + "value": "928120" + } + ], + "version": 2022 +} diff --git a/galaxies/naics.json b/galaxies/naics.json new file mode 100644 index 0000000..116eec0 --- /dev/null +++ b/galaxies/naics.json @@ -0,0 +1,9 @@ +{ + "description": "North American Industry Classification System - NAICS", + "icon": "industry", + "name": "NAICS", + "namespace": "", + "type": "naics", + "uuid": "b73ecad4-6529-4625-8c4f-ee3ef703a72a", + "version": 1 +} From 04739a7e95218eadef2e90f6b952c1b49facf2b1 Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 30 Oct 2023 14:54:22 +0100 Subject: [PATCH 12/20] trim --- clusters/naics.json | 2214 +++++++++++++++++++++---------------------- 1 file changed, 1107 insertions(+), 1107 deletions(-) diff --git a/clusters/naics.json b/clusters/naics.json index ab985bb..9c61cea 100644 --- a/clusters/naics.json +++ b/clusters/naics.json @@ -279,7 +279,7 @@ "value": "11112" }, { - "description": "Oilseed (except Soybean) Farming ", + "description": "Oilseed (except Soybean) Farming", "related": [ { "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", @@ -321,7 +321,7 @@ "value": "11113" }, { - "description": "Dry Pea and Bean Farming ", + "description": "Dry Pea and Bean Farming", "related": [ { "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", @@ -405,7 +405,7 @@ "value": "11115" }, { - "description": "Corn Farming ", + "description": "Corn Farming", "related": [ { "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", @@ -482,7 +482,7 @@ "value": "11119" }, { - "description": "Oilseed and Grain Combination Farming ", + "description": "Oilseed and Grain Combination Farming", "related": [ { "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", @@ -496,7 +496,7 @@ "value": "111191" }, { - "description": "All Other Grain Farming ", + "description": "All Other Grain Farming", "related": [ { "dest-uuid": "9bf32799-c922-45fa-8b1d-43ed1542a81e", @@ -559,7 +559,7 @@ "value": "11121" }, { - "description": "Potato Farming ", + "description": "Potato Farming", "related": [ { "dest-uuid": "9b088cdc-c879-46d1-bd30-db7d2287fee9", @@ -573,7 +573,7 @@ "value": "111211" }, { - "description": "Other Vegetable (except Potato) and Melon Farming ", + "description": "Other Vegetable (except Potato) and Melon Farming", "related": [ { "dest-uuid": "9b088cdc-c879-46d1-bd30-db7d2287fee9", @@ -748,7 +748,7 @@ "value": "11132" }, { - "description": "Citrus (except Orange) Groves ", + "description": "Citrus (except Orange) Groves", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -783,7 +783,7 @@ "value": "11133" }, { - "description": "Apple Orchards ", + "description": "Apple Orchards", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -797,7 +797,7 @@ "value": "111331" }, { - "description": "Grape Vineyards ", + "description": "Grape Vineyards", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -811,7 +811,7 @@ "value": "111332" }, { - "description": "Strawberry Farming ", + "description": "Strawberry Farming", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -825,7 +825,7 @@ "value": "111333" }, { - "description": "Berry (except Strawberry) Farming ", + "description": "Berry (except Strawberry) Farming", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -839,7 +839,7 @@ "value": "111334" }, { - "description": "Tree Nut Farming ", + "description": "Tree Nut Farming", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -853,7 +853,7 @@ "value": "111335" }, { - "description": "Fruit and Tree Nut Combination Farming ", + "description": "Fruit and Tree Nut Combination Farming", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -867,7 +867,7 @@ "value": "111336" }, { - "description": "Other Noncitrus Fruit Farming ", + "description": "Other Noncitrus Fruit Farming", "related": [ { "dest-uuid": "55facef7-2af2-46f3-a951-c0f0ff302811", @@ -951,7 +951,7 @@ "value": "11141" }, { - "description": "Mushroom Production ", + "description": "Mushroom Production", "related": [ { "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", @@ -965,7 +965,7 @@ "value": "111411" }, { - "description": "Other Food Crops Grown Under Cover ", + "description": "Other Food Crops Grown Under Cover", "related": [ { "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", @@ -993,7 +993,7 @@ "value": "11142" }, { - "description": "Nursery and Tree Production ", + "description": "Nursery and Tree Production", "related": [ { "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", @@ -1007,7 +1007,7 @@ "value": "111421" }, { - "description": "Floriculture Production ", + "description": "Floriculture Production", "related": [ { "dest-uuid": "b9b03e15-aeae-4c7d-a915-7e1ad46d91bb", @@ -1266,7 +1266,7 @@ "value": "11194" }, { - "description": "Hay Farming ", + "description": "Hay Farming", "related": [ { "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", @@ -1301,7 +1301,7 @@ "value": "11199" }, { - "description": "Sugar Beet Farming ", + "description": "Sugar Beet Farming", "related": [ { "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", @@ -1315,7 +1315,7 @@ "value": "111991" }, { - "description": "Peanut Farming ", + "description": "Peanut Farming", "related": [ { "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", @@ -1329,7 +1329,7 @@ "value": "111992" }, { - "description": "All Other Miscellaneous Crop Farming ", + "description": "All Other Miscellaneous Crop Farming", "related": [ { "dest-uuid": "652d8e34-2a9f-4ef9-8315-25b44c08c38f", @@ -1476,7 +1476,7 @@ "value": "11211" }, { - "description": "Beef Cattle Ranching and Farming ", + "description": "Beef Cattle Ranching and Farming", "related": [ { "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", @@ -1490,7 +1490,7 @@ "value": "112111" }, { - "description": "Cattle Feedlots ", + "description": "Cattle Feedlots", "related": [ { "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", @@ -1567,7 +1567,7 @@ "value": "11213" }, { - "description": "Dual-Purpose Cattle Ranching and Farming ", + "description": "Dual-Purpose Cattle Ranching and Farming", "related": [ { "dest-uuid": "032d77f6-c0b4-444a-adb8-abd03a564636", @@ -1637,7 +1637,7 @@ "value": "11221" }, { - "description": "Hog and Pig Farming ", + "description": "Hog and Pig Farming", "related": [ { "dest-uuid": "8b7370fe-bec7-4b73-8775-bb39417f4ee5", @@ -1763,7 +1763,7 @@ "value": "11231" }, { - "description": "Chicken Egg Production ", + "description": "Chicken Egg Production", "related": [ { "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", @@ -1805,7 +1805,7 @@ "value": "11232" }, { - "description": "Broilers and Other Meat Type Chicken Production ", + "description": "Broilers and Other Meat Type Chicken Production", "related": [ { "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", @@ -1931,7 +1931,7 @@ "value": "11239" }, { - "description": "Other Poultry Production ", + "description": "Other Poultry Production", "related": [ { "dest-uuid": "f9db3e59-4021-45a5-8494-d3b7785ea095", @@ -2134,7 +2134,7 @@ "value": "11251" }, { - "description": "Finfish Farming and Fish Hatcheries ", + "description": "Finfish Farming and Fish Hatcheries", "related": [ { "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", @@ -2148,7 +2148,7 @@ "value": "112511" }, { - "description": "Shellfish Farming ", + "description": "Shellfish Farming", "related": [ { "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", @@ -2162,7 +2162,7 @@ "value": "112512" }, { - "description": "Other Aquaculture ", + "description": "Other Aquaculture", "related": [ { "dest-uuid": "2116708f-f421-40d9-ba56-05e20dabcdb5", @@ -2393,7 +2393,7 @@ "value": "11299" }, { - "description": "All Other Animal Production ", + "description": "All Other Animal Production", "related": [ { "dest-uuid": "9c854fd6-2944-4ebb-be17-1490e71b13ad", @@ -2568,7 +2568,7 @@ "value": "11321" }, { - "description": "Forest Nurseries and Gathering of Forest Products ", + "description": "Forest Nurseries and Gathering of Forest Products", "related": [ { "dest-uuid": "186cebed-dbef-41a9-8927-b21cec10cd79", @@ -2638,7 +2638,7 @@ "value": "11331" }, { - "description": "Logging ", + "description": "Logging", "related": [ { "dest-uuid": "780fc42e-f5e5-4651-842f-2b5ceb223495", @@ -2743,7 +2743,7 @@ "value": "11411" }, { - "description": "Finfish Fishing ", + "description": "Finfish Fishing", "related": [ { "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", @@ -2757,7 +2757,7 @@ "value": "114111" }, { - "description": "Shellfish Fishing ", + "description": "Shellfish Fishing", "related": [ { "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", @@ -2771,7 +2771,7 @@ "value": "114112" }, { - "description": "Other Marine Fishing ", + "description": "Other Marine Fishing", "related": [ { "dest-uuid": "f211f4cb-77c1-425e-987f-838efee6786d", @@ -2967,7 +2967,7 @@ "value": "11511" }, { - "description": "Cotton Ginning ", + "description": "Cotton Ginning", "related": [ { "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", @@ -2981,7 +2981,7 @@ "value": "115111" }, { - "description": "Soil Preparation, Planting, and Cultivating ", + "description": "Soil Preparation, Planting, and Cultivating", "related": [ { "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", @@ -2995,7 +2995,7 @@ "value": "115112" }, { - "description": "Crop Harvesting, Primarily by Machine ", + "description": "Crop Harvesting, Primarily by Machine", "related": [ { "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", @@ -3009,7 +3009,7 @@ "value": "115113" }, { - "description": "Postharvest Crop Activities (except Cotton Ginning) ", + "description": "Postharvest Crop Activities (except Cotton Ginning)", "related": [ { "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", @@ -3023,7 +3023,7 @@ "value": "115114" }, { - "description": "Farm Labor Contractors and Crew Leaders ", + "description": "Farm Labor Contractors and Crew Leaders", "related": [ { "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", @@ -3037,7 +3037,7 @@ "value": "115115" }, { - "description": "Farm Management Services ", + "description": "Farm Management Services", "related": [ { "dest-uuid": "6db04e7b-51f1-4fcb-a13a-1ec93488c725", @@ -3450,7 +3450,7 @@ "value": "21211" }, { - "description": "Surface Coal Mining ", + "description": "Surface Coal Mining", "related": [ { "dest-uuid": "8c13b54a-f007-4b41-88e2-919f47ddc568", @@ -3464,7 +3464,7 @@ "value": "212114" }, { - "description": "Underground Coal Mining ", + "description": "Underground Coal Mining", "related": [ { "dest-uuid": "8c13b54a-f007-4b41-88e2-919f47ddc568", @@ -3611,7 +3611,7 @@ "value": "21222" }, { - "description": "Gold Ore and Silver Ore Mining ", + "description": "Gold Ore and Silver Ore Mining", "related": [ { "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", @@ -3653,7 +3653,7 @@ "value": "21223" }, { - "description": "Copper, Nickel, Lead, and Zinc Mining ", + "description": "Copper, Nickel, Lead, and Zinc Mining", "related": [ { "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", @@ -3695,7 +3695,7 @@ "value": "21229" }, { - "description": "Other Metal Ore Mining ", + "description": "Other Metal Ore Mining", "related": [ { "dest-uuid": "76085bfb-a7b5-46b9-a74b-212c8f31e1c9", @@ -3821,7 +3821,7 @@ "value": "21231" }, { - "description": "Dimension Stone Mining and Quarrying ", + "description": "Dimension Stone Mining and Quarrying", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -3835,7 +3835,7 @@ "value": "212311" }, { - "description": "Crushed and Broken Limestone Mining and Quarrying ", + "description": "Crushed and Broken Limestone Mining and Quarrying", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -3849,7 +3849,7 @@ "value": "212312" }, { - "description": "Crushed and Broken Granite Mining and Quarrying ", + "description": "Crushed and Broken Granite Mining and Quarrying", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -3863,7 +3863,7 @@ "value": "212313" }, { - "description": "Other Crushed and Broken Stone Mining and Quarrying ", + "description": "Other Crushed and Broken Stone Mining and Quarrying", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -3891,7 +3891,7 @@ "value": "21232" }, { - "description": "Construction Sand and Gravel Mining ", + "description": "Construction Sand and Gravel Mining", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -3905,7 +3905,7 @@ "value": "212321" }, { - "description": "Industrial Sand Mining ", + "description": "Industrial Sand Mining", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -3919,7 +3919,7 @@ "value": "212322" }, { - "description": "Kaolin, Clay, and Ceramic and Refractory Minerals Mining ", + "description": "Kaolin, Clay, and Ceramic and Refractory Minerals Mining", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -3954,7 +3954,7 @@ "value": "21239" }, { - "description": "Other Nonmetallic Mineral Mining and Quarrying ", + "description": "Other Nonmetallic Mineral Mining and Quarrying", "related": [ { "dest-uuid": "0355f515-2177-4200-93d5-ff3aed9bf318", @@ -4080,7 +4080,7 @@ "value": "213111" }, { - "description": "Support Activities for Oil and Gas Operations ", + "description": "Support Activities for Oil and Gas Operations", "related": [ { "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", @@ -4094,7 +4094,7 @@ "value": "213112" }, { - "description": "Support Activities for Coal Mining ", + "description": "Support Activities for Coal Mining", "related": [ { "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", @@ -4108,7 +4108,7 @@ "value": "213113" }, { - "description": "Support Activities for Metal Mining ", + "description": "Support Activities for Metal Mining", "related": [ { "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", @@ -4122,7 +4122,7 @@ "value": "213114" }, { - "description": "Support Activities for Nonmetallic Minerals (except Fuels) Mining ", + "description": "Support Activities for Nonmetallic Minerals (except Fuels) Mining", "related": [ { "dest-uuid": "fa38ec26-2ba7-4416-9b62-29ffa767731f", @@ -4150,7 +4150,7 @@ "value": "22" }, { - "description": "Utilities ", + "description": "Utilities", "related": [ { "dest-uuid": "97fc4eee-ed1f-477c-99d5-9530c8e3b13b", @@ -4283,7 +4283,7 @@ "value": "2211" }, { - "description": "Electric Power Generation ", + "description": "Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4297,7 +4297,7 @@ "value": "22111" }, { - "description": "Hydroelectric Power Generation ", + "description": "Hydroelectric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4311,7 +4311,7 @@ "value": "221111" }, { - "description": "Fossil Fuel Electric Power Generation ", + "description": "Fossil Fuel Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4325,7 +4325,7 @@ "value": "221112" }, { - "description": "Nuclear Electric Power Generation ", + "description": "Nuclear Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4339,7 +4339,7 @@ "value": "221113" }, { - "description": "Solar Electric Power Generation ", + "description": "Solar Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4353,7 +4353,7 @@ "value": "221114" }, { - "description": "Wind Electric Power Generation ", + "description": "Wind Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4367,7 +4367,7 @@ "value": "221115" }, { - "description": "Geothermal Electric Power Generation ", + "description": "Geothermal Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4381,7 +4381,7 @@ "value": "221116" }, { - "description": "Biomass Electric Power Generation ", + "description": "Biomass Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4395,7 +4395,7 @@ "value": "221117" }, { - "description": "Other Electric Power Generation ", + "description": "Other Electric Power Generation", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4409,7 +4409,7 @@ "value": "221118" }, { - "description": "Electric Power Transmission, Control, and Distribution ", + "description": "Electric Power Transmission, Control, and Distribution", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4423,7 +4423,7 @@ "value": "22112" }, { - "description": "Electric Bulk Power Transmission and Control ", + "description": "Electric Bulk Power Transmission and Control", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4437,7 +4437,7 @@ "value": "221121" }, { - "description": "Electric Power Distribution ", + "description": "Electric Power Distribution", "related": [ { "dest-uuid": "016dc7f5-21a5-423b-b488-d8ac229f411f", @@ -4451,7 +4451,7 @@ "value": "221122" }, { - "description": "Natural Gas Distribution ", + "description": "Natural Gas Distribution", "related": [ { "dest-uuid": "0868bbea-64a4-4987-a5d1-15180a13d244", @@ -4479,7 +4479,7 @@ "value": "2212" }, { - "description": "Natural Gas Distribution ", + "description": "Natural Gas Distribution", "related": [ { "dest-uuid": "80a283aa-4ef6-4b37-bf0d-1886617395c2", @@ -4500,7 +4500,7 @@ "value": "22121" }, { - "description": "Natural Gas Distribution ", + "description": "Natural Gas Distribution", "related": [ { "dest-uuid": "80a283aa-4ef6-4b37-bf0d-1886617395c2", @@ -4521,7 +4521,7 @@ "value": "221210" }, { - "description": "Water, Sewage and Other Systems ", + "description": "Water, Sewage and Other Systems", "related": [ { "dest-uuid": "0868bbea-64a4-4987-a5d1-15180a13d244", @@ -4577,7 +4577,7 @@ "value": "2213" }, { - "description": "Water Supply and Irrigation Systems ", + "description": "Water Supply and Irrigation Systems", "related": [ { "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", @@ -4598,7 +4598,7 @@ "value": "22131" }, { - "description": "Water Supply and Irrigation Systems ", + "description": "Water Supply and Irrigation Systems", "related": [ { "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", @@ -4619,7 +4619,7 @@ "value": "221310" }, { - "description": "Sewage Treatment Facilities ", + "description": "Sewage Treatment Facilities", "related": [ { "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", @@ -4640,7 +4640,7 @@ "value": "22132" }, { - "description": "Sewage Treatment Facilities ", + "description": "Sewage Treatment Facilities", "related": [ { "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", @@ -4661,7 +4661,7 @@ "value": "221320" }, { - "description": "Steam and Air-Conditioning Supply ", + "description": "Steam and Air-Conditioning Supply", "related": [ { "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", @@ -4682,7 +4682,7 @@ "value": "22133" }, { - "description": "Steam and Air-Conditioning Supply ", + "description": "Steam and Air-Conditioning Supply", "related": [ { "dest-uuid": "620dfc27-375f-4147-9fe3-625b2dff349a", @@ -4822,7 +4822,7 @@ "value": "23611" }, { - "description": "New Single-Family Housing Construction (except For-Sale Builders) ", + "description": "New Single-Family Housing Construction (except For-Sale Builders)", "related": [ { "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", @@ -4836,7 +4836,7 @@ "value": "236115" }, { - "description": "New Multifamily Housing Construction (except For-Sale Builders) ", + "description": "New Multifamily Housing Construction (except For-Sale Builders)", "related": [ { "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", @@ -4850,7 +4850,7 @@ "value": "236116" }, { - "description": "New Housing For-Sale Builders ", + "description": "New Housing For-Sale Builders", "related": [ { "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", @@ -4864,7 +4864,7 @@ "value": "236117" }, { - "description": "Residential Remodelers ", + "description": "Residential Remodelers", "related": [ { "dest-uuid": "62fba3f6-f81b-4200-9aed-ed2d17c0e157", @@ -4941,7 +4941,7 @@ "value": "23621" }, { - "description": "Industrial Building Construction ", + "description": "Industrial Building Construction", "related": [ { "dest-uuid": "6b107009-5116-432f-8dfe-e66a91e01561", @@ -4983,7 +4983,7 @@ "value": "23622" }, { - "description": "Commercial and Institutional Building Construction ", + "description": "Commercial and Institutional Building Construction", "related": [ { "dest-uuid": "6b107009-5116-432f-8dfe-e66a91e01561", @@ -5123,7 +5123,7 @@ "value": "23711" }, { - "description": "Water and Sewer Line and Related Structures Construction ", + "description": "Water and Sewer Line and Related Structures Construction", "related": [ { "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", @@ -5165,7 +5165,7 @@ "value": "23712" }, { - "description": "Oil and Gas Pipeline and Related Structures Construction ", + "description": "Oil and Gas Pipeline and Related Structures Construction", "related": [ { "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", @@ -5207,7 +5207,7 @@ "value": "23713" }, { - "description": "Power and Communication Line and Related Structures Construction ", + "description": "Power and Communication Line and Related Structures Construction", "related": [ { "dest-uuid": "225871f1-936a-49f4-afef-bc47b3d4cf8f", @@ -5277,7 +5277,7 @@ "value": "23721" }, { - "description": "Land Subdivision ", + "description": "Land Subdivision", "related": [ { "dest-uuid": "73e76411-4e62-4b90-a497-e8b1238634a0", @@ -5347,7 +5347,7 @@ "value": "23731" }, { - "description": "Highway, Street, and Bridge Construction ", + "description": "Highway, Street, and Bridge Construction", "related": [ { "dest-uuid": "7d9844d6-27a1-4013-8843-dcbd7a4c1e77", @@ -5417,7 +5417,7 @@ "value": "23799" }, { - "description": "Other Heavy and Civil Engineering Construction ", + "description": "Other Heavy and Civil Engineering Construction", "related": [ { "dest-uuid": "0654d572-15b3-4324-ac52-b58be4a3d1c7", @@ -5606,7 +5606,7 @@ "value": "2381" }, { - "description": "Poured Concrete Foundation and Structure Contractors ", + "description": "Poured Concrete Foundation and Structure Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5627,7 +5627,7 @@ "value": "23811" }, { - "description": "Poured Concrete Foundation and Structure Contractors ", + "description": "Poured Concrete Foundation and Structure Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5648,7 +5648,7 @@ "value": "238110" }, { - "description": "Structural Steel and Precast Concrete Contractors ", + "description": "Structural Steel and Precast Concrete Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5669,7 +5669,7 @@ "value": "23812" }, { - "description": "Structural Steel and Precast Concrete Contractors ", + "description": "Structural Steel and Precast Concrete Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5690,7 +5690,7 @@ "value": "238120" }, { - "description": "Framing Contractors ", + "description": "Framing Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5711,7 +5711,7 @@ "value": "23813" }, { - "description": "Framing Contractors ", + "description": "Framing Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5732,7 +5732,7 @@ "value": "238130" }, { - "description": "Masonry Contractors ", + "description": "Masonry Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5753,7 +5753,7 @@ "value": "23814" }, { - "description": "Masonry Contractors ", + "description": "Masonry Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5774,7 +5774,7 @@ "value": "238140" }, { - "description": "Glass and Glazing Contractors ", + "description": "Glass and Glazing Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5795,7 +5795,7 @@ "value": "23815" }, { - "description": "Glass and Glazing Contractors ", + "description": "Glass and Glazing Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5816,7 +5816,7 @@ "value": "238150" }, { - "description": "Roofing Contractors ", + "description": "Roofing Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5837,7 +5837,7 @@ "value": "23816" }, { - "description": "Roofing Contractors ", + "description": "Roofing Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5858,7 +5858,7 @@ "value": "238160" }, { - "description": "Siding Contractors ", + "description": "Siding Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5879,7 +5879,7 @@ "value": "23817" }, { - "description": "Siding Contractors ", + "description": "Siding Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5900,7 +5900,7 @@ "value": "238170" }, { - "description": "Other Foundation, Structure, and Building Exterior Contractors ", + "description": "Other Foundation, Structure, and Building Exterior Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -5921,7 +5921,7 @@ "value": "23819" }, { - "description": "Other Foundation, Structure, and Building Exterior Contractors ", + "description": "Other Foundation, Structure, and Building Exterior Contractors", "related": [ { "dest-uuid": "8a04c9c7-a35a-4b9c-8806-2e2747298b92", @@ -6061,7 +6061,7 @@ "value": "23822" }, { - "description": "Plumbing, Heating, and Air-Conditioning Contractors ", + "description": "Plumbing, Heating, and Air-Conditioning Contractors", "related": [ { "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", @@ -6103,7 +6103,7 @@ "value": "23829" }, { - "description": "Other Building Equipment Contractors ", + "description": "Other Building Equipment Contractors", "related": [ { "dest-uuid": "a26e4fdf-834f-4b57-9b50-6486a18ef057", @@ -6243,7 +6243,7 @@ "value": "23831" }, { - "description": "Drywall and Insulation Contractors ", + "description": "Drywall and Insulation Contractors", "related": [ { "dest-uuid": "38aef931-91a0-4340-bfba-07a8126735c7", @@ -6725,7 +6725,7 @@ "value": "31111" }, { - "description": "Dog and Cat Food Manufacturing ", + "description": "Dog and Cat Food Manufacturing", "related": [ { "dest-uuid": "f8194f33-3590-45a8-81d3-405784d2cb05", @@ -6739,7 +6739,7 @@ "value": "311111" }, { - "description": "Other Animal Food Manufacturing ", + "description": "Other Animal Food Manufacturing", "related": [ { "dest-uuid": "f8194f33-3590-45a8-81d3-405784d2cb05", @@ -6851,7 +6851,7 @@ "value": "31121" }, { - "description": "Flour Milling ", + "description": "Flour Milling", "related": [ { "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", @@ -6865,7 +6865,7 @@ "value": "311211" }, { - "description": "Rice Milling ", + "description": "Rice Milling", "related": [ { "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", @@ -6879,7 +6879,7 @@ "value": "311212" }, { - "description": "Malt Manufacturing ", + "description": "Malt Manufacturing", "related": [ { "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", @@ -6907,7 +6907,7 @@ "value": "31122" }, { - "description": "Wet Corn Milling and Starch Manufacturing ", + "description": "Wet Corn Milling and Starch Manufacturing", "related": [ { "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", @@ -6921,7 +6921,7 @@ "value": "311221" }, { - "description": "Soybean and Other Oilseed Processing ", + "description": "Soybean and Other Oilseed Processing", "related": [ { "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", @@ -6935,7 +6935,7 @@ "value": "311224" }, { - "description": "Fats and Oils Refining and Blending ", + "description": "Fats and Oils Refining and Blending", "related": [ { "dest-uuid": "2924f1f3-f06a-4134-b806-7fe0a47d6af7", @@ -7075,7 +7075,7 @@ "value": "31131" }, { - "description": "Beet Sugar Manufacturing ", + "description": "Beet Sugar Manufacturing", "related": [ { "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", @@ -7089,7 +7089,7 @@ "value": "311313" }, { - "description": "Cane Sugar Manufacturing ", + "description": "Cane Sugar Manufacturing", "related": [ { "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", @@ -7159,7 +7159,7 @@ "value": "31135" }, { - "description": "Chocolate and Confectionery Manufacturing from Cacao Beans ", + "description": "Chocolate and Confectionery Manufacturing from Cacao Beans", "related": [ { "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", @@ -7173,7 +7173,7 @@ "value": "311351" }, { - "description": "Confectionery Manufacturing from Purchased Chocolate ", + "description": "Confectionery Manufacturing from Purchased Chocolate", "related": [ { "dest-uuid": "92b4b04f-2d07-4ffe-8d6c-2b0254fe438c", @@ -7264,7 +7264,7 @@ "value": "31141" }, { - "description": "Frozen Fruit, Juice, and Vegetable Manufacturing ", + "description": "Frozen Fruit, Juice, and Vegetable Manufacturing", "related": [ { "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", @@ -7278,7 +7278,7 @@ "value": "311411" }, { - "description": "Frozen Specialty Food Manufacturing ", + "description": "Frozen Specialty Food Manufacturing", "related": [ { "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", @@ -7306,7 +7306,7 @@ "value": "31142" }, { - "description": "Fruit and Vegetable Canning ", + "description": "Fruit and Vegetable Canning", "related": [ { "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", @@ -7320,7 +7320,7 @@ "value": "311421" }, { - "description": "Specialty Canning ", + "description": "Specialty Canning", "related": [ { "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", @@ -7334,7 +7334,7 @@ "value": "311422" }, { - "description": "Dried and Dehydrated Food Manufacturing ", + "description": "Dried and Dehydrated Food Manufacturing", "related": [ { "dest-uuid": "f5b46d19-bb8c-4694-aa05-33ca294d11d4", @@ -7425,7 +7425,7 @@ "value": "31151" }, { - "description": "Fluid Milk Manufacturing ", + "description": "Fluid Milk Manufacturing", "related": [ { "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", @@ -7439,7 +7439,7 @@ "value": "311511" }, { - "description": "Creamery Butter Manufacturing ", + "description": "Creamery Butter Manufacturing", "related": [ { "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", @@ -7453,7 +7453,7 @@ "value": "311512" }, { - "description": "Cheese Manufacturing ", + "description": "Cheese Manufacturing", "related": [ { "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", @@ -7467,7 +7467,7 @@ "value": "311513" }, { - "description": "Dry, Condensed, and Evaporated Dairy Product Manufacturing ", + "description": "Dry, Condensed, and Evaporated Dairy Product Manufacturing", "related": [ { "dest-uuid": "96080c88-b8bd-4026-9fe7-81e9e630fab8", @@ -7586,7 +7586,7 @@ "value": "31161" }, { - "description": "Animal (except Poultry) Slaughtering ", + "description": "Animal (except Poultry) Slaughtering", "related": [ { "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", @@ -7600,7 +7600,7 @@ "value": "311611" }, { - "description": "Meat Processed from Carcasses ", + "description": "Meat Processed from Carcasses", "related": [ { "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", @@ -7614,7 +7614,7 @@ "value": "311612" }, { - "description": "Rendering and Meat Byproduct Processing ", + "description": "Rendering and Meat Byproduct Processing", "related": [ { "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", @@ -7628,7 +7628,7 @@ "value": "311613" }, { - "description": "Poultry Processing ", + "description": "Poultry Processing", "related": [ { "dest-uuid": "09b5d705-873d-4b21-baf7-fa838491429f", @@ -7803,7 +7803,7 @@ "value": "31181" }, { - "description": "Retail Bakeries ", + "description": "Retail Bakeries", "related": [ { "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", @@ -7817,7 +7817,7 @@ "value": "311811" }, { - "description": "Commercial Bakeries ", + "description": "Commercial Bakeries", "related": [ { "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", @@ -7831,7 +7831,7 @@ "value": "311812" }, { - "description": "Frozen Cakes, Pies, and Other Pastries Manufacturing ", + "description": "Frozen Cakes, Pies, and Other Pastries Manufacturing", "related": [ { "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", @@ -7859,7 +7859,7 @@ "value": "31182" }, { - "description": "Cookie and Cracker Manufacturing ", + "description": "Cookie and Cracker Manufacturing", "related": [ { "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", @@ -7873,7 +7873,7 @@ "value": "311821" }, { - "description": "Dry Pasta, Dough, and Flour Mixes Manufacturing from Purchased Flour ", + "description": "Dry Pasta, Dough, and Flour Mixes Manufacturing from Purchased Flour", "related": [ { "dest-uuid": "a5810582-8daa-439a-aa25-a1638fe2c492", @@ -8048,7 +8048,7 @@ "value": "31191" }, { - "description": "Roasted Nuts and Peanut Butter Manufacturing ", + "description": "Roasted Nuts and Peanut Butter Manufacturing", "related": [ { "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", @@ -8062,7 +8062,7 @@ "value": "311911" }, { - "description": "Other Snack Food Manufacturing ", + "description": "Other Snack Food Manufacturing", "related": [ { "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", @@ -8097,7 +8097,7 @@ "value": "31192" }, { - "description": "Coffee and Tea Manufacturing ", + "description": "Coffee and Tea Manufacturing", "related": [ { "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", @@ -8174,7 +8174,7 @@ "value": "31194" }, { - "description": "Mayonnaise, Dressing, and Other Prepared Sauce Manufacturing ", + "description": "Mayonnaise, Dressing, and Other Prepared Sauce Manufacturing", "related": [ { "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", @@ -8188,7 +8188,7 @@ "value": "311941" }, { - "description": "Spice and Extract Manufacturing ", + "description": "Spice and Extract Manufacturing", "related": [ { "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", @@ -8216,7 +8216,7 @@ "value": "31199" }, { - "description": "Perishable Prepared Food Manufacturing ", + "description": "Perishable Prepared Food Manufacturing", "related": [ { "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", @@ -8230,7 +8230,7 @@ "value": "311991" }, { - "description": "All Other Miscellaneous Food Manufacturing ", + "description": "All Other Miscellaneous Food Manufacturing", "related": [ { "dest-uuid": "1b30133f-fc34-47b5-bca8-851962a38544", @@ -8363,7 +8363,7 @@ "value": "31211" }, { - "description": "Soft Drink Manufacturing ", + "description": "Soft Drink Manufacturing", "related": [ { "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", @@ -8377,7 +8377,7 @@ "value": "312111" }, { - "description": "Bottled Water Manufacturing ", + "description": "Bottled Water Manufacturing", "related": [ { "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", @@ -8391,7 +8391,7 @@ "value": "312112" }, { - "description": "Ice Manufacturing ", + "description": "Ice Manufacturing", "related": [ { "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", @@ -8468,7 +8468,7 @@ "value": "31213" }, { - "description": "Wineries ", + "description": "Wineries", "related": [ { "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", @@ -8510,7 +8510,7 @@ "value": "31214" }, { - "description": "Distilleries ", + "description": "Distilleries", "related": [ { "dest-uuid": "2617dcaf-71e3-402b-a71f-4178b11f5510", @@ -8580,7 +8580,7 @@ "value": "31223" }, { - "description": "Tobacco Manufacturing ", + "description": "Tobacco Manufacturing", "related": [ { "dest-uuid": "bba2d5b5-f7a9-4763-9cef-868fb4c425de", @@ -8678,7 +8678,7 @@ "value": "31311" }, { - "description": "Fiber, Yarn, and Thread Mills ", + "description": "Fiber, Yarn, and Thread Mills", "related": [ { "dest-uuid": "7be74537-3e51-44f3-bf38-9cb3889f4015", @@ -9000,7 +9000,7 @@ "value": "31331" }, { - "description": "Textile and Fabric Finishing Mills ", + "description": "Textile and Fabric Finishing Mills", "related": [ { "dest-uuid": "a54cd85c-5a48-4378-8340-b92ac15eeba3", @@ -9280,7 +9280,7 @@ "value": "31491" }, { - "description": "Textile Bag and Canvas Mills ", + "description": "Textile Bag and Canvas Mills", "related": [ { "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", @@ -9315,7 +9315,7 @@ "value": "31499" }, { - "description": "Rope, Cordage, Twine, Tire Cord, and Tire Fabric Mills ", + "description": "Rope, Cordage, Twine, Tire Cord, and Tire Fabric Mills", "related": [ { "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", @@ -9329,7 +9329,7 @@ "value": "314994" }, { - "description": "All Other Miscellaneous Textile Product Mills ", + "description": "All Other Miscellaneous Textile Product Mills", "related": [ { "dest-uuid": "c266dd21-9394-4aa8-86ca-b5f9d418db6b", @@ -9483,7 +9483,7 @@ "value": "3152" }, { - "description": "Cut and Sew Apparel Contractors ", + "description": "Cut and Sew Apparel Contractors", "related": [ { "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", @@ -9504,7 +9504,7 @@ "value": "31521" }, { - "description": "Cut and Sew Apparel Contractors ", + "description": "Cut and Sew Apparel Contractors", "related": [ { "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", @@ -9525,7 +9525,7 @@ "value": "315210" }, { - "description": "Cut and Sew Apparel Manufacturing (except Contractors) ", + "description": "Cut and Sew Apparel Manufacturing (except Contractors)", "related": [ { "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", @@ -9546,7 +9546,7 @@ "value": "31525" }, { - "description": "Cut and Sew Apparel Manufacturing (except Contractors) ", + "description": "Cut and Sew Apparel Manufacturing (except Contractors)", "related": [ { "dest-uuid": "66ba1df1-9a98-437c-9922-9b2cafeafa63", @@ -9616,7 +9616,7 @@ "value": "31599" }, { - "description": "Apparel Accessories and Other Apparel Manufacturing ", + "description": "Apparel Accessories and Other Apparel Manufacturing", "related": [ { "dest-uuid": "ab90ccd7-e096-4913-8066-5d97bf4c5108", @@ -9784,7 +9784,7 @@ "value": "31621" }, { - "description": "Footwear Manufacturing ", + "description": "Footwear Manufacturing", "related": [ { "dest-uuid": "fe4e4e08-df2c-422e-bbfb-471afdc2f0d6", @@ -9854,7 +9854,7 @@ "value": "31699" }, { - "description": "Other Leather and Allied Product Manufacturing ", + "description": "Other Leather and Allied Product Manufacturing", "related": [ { "dest-uuid": "4eab73bb-043c-4565-889d-4672aabac991", @@ -9952,7 +9952,7 @@ "value": "32111" }, { - "description": "Sawmills ", + "description": "Sawmills", "related": [ { "dest-uuid": "4b143202-d0c3-48dd-acee-7e7abbae972e", @@ -9966,7 +9966,7 @@ "value": "321113" }, { - "description": "Wood Preservation ", + "description": "Wood Preservation", "related": [ { "dest-uuid": "4b143202-d0c3-48dd-acee-7e7abbae972e", @@ -10043,7 +10043,7 @@ "value": "32121" }, { - "description": "Hardwood Veneer and Plywood Manufacturing ", + "description": "Hardwood Veneer and Plywood Manufacturing", "related": [ { "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", @@ -10057,7 +10057,7 @@ "value": "321211" }, { - "description": "Softwood Veneer and Plywood Manufacturing ", + "description": "Softwood Veneer and Plywood Manufacturing", "related": [ { "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", @@ -10071,7 +10071,7 @@ "value": "321212" }, { - "description": "Engineered Wood Member Manufacturing ", + "description": "Engineered Wood Member Manufacturing", "related": [ { "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", @@ -10085,7 +10085,7 @@ "value": "321215" }, { - "description": "Reconstituted Wood Product Manufacturing ", + "description": "Reconstituted Wood Product Manufacturing", "related": [ { "dest-uuid": "0827f265-cfb4-4991-98c9-f678f908a486", @@ -10197,7 +10197,7 @@ "value": "32191" }, { - "description": "Wood Window and Door Manufacturing ", + "description": "Wood Window and Door Manufacturing", "related": [ { "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", @@ -10211,7 +10211,7 @@ "value": "321911" }, { - "description": "Cut Stock, Resawing Lumber, and Planing ", + "description": "Cut Stock, Resawing Lumber, and Planing", "related": [ { "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", @@ -10225,7 +10225,7 @@ "value": "321912" }, { - "description": "Other Millwork (including Flooring) ", + "description": "Other Millwork (including Flooring)", "related": [ { "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", @@ -10295,7 +10295,7 @@ "value": "32199" }, { - "description": "Manufactured Home (Mobile Home) Manufacturing ", + "description": "Manufactured Home (Mobile Home) Manufacturing", "related": [ { "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", @@ -10309,7 +10309,7 @@ "value": "321991" }, { - "description": "Prefabricated Wood Building Manufacturing ", + "description": "Prefabricated Wood Building Manufacturing", "related": [ { "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", @@ -10323,7 +10323,7 @@ "value": "321992" }, { - "description": "All Other Miscellaneous Wood Product Manufacturing ", + "description": "All Other Miscellaneous Wood Product Manufacturing", "related": [ { "dest-uuid": "0076607b-43a1-444c-b28b-60832de0076f", @@ -10435,7 +10435,7 @@ "value": "32211" }, { - "description": "Pulp Mills ", + "description": "Pulp Mills", "related": [ { "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", @@ -10477,7 +10477,7 @@ "value": "32212" }, { - "description": "Paper Mills ", + "description": "Paper Mills", "related": [ { "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", @@ -10519,7 +10519,7 @@ "value": "32213" }, { - "description": "Paperboard Mills ", + "description": "Paperboard Mills", "related": [ { "dest-uuid": "cdfa2d3a-dc1b-4b77-a103-60d39dcb372c", @@ -10645,7 +10645,7 @@ "value": "32221" }, { - "description": "Corrugated and Solid Fiber Box Manufacturing ", + "description": "Corrugated and Solid Fiber Box Manufacturing", "related": [ { "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", @@ -10659,7 +10659,7 @@ "value": "322211" }, { - "description": "Folding Paperboard Box Manufacturing ", + "description": "Folding Paperboard Box Manufacturing", "related": [ { "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", @@ -10673,7 +10673,7 @@ "value": "322212" }, { - "description": "Other Paperboard Container Manufacturing ", + "description": "Other Paperboard Container Manufacturing", "related": [ { "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", @@ -10785,7 +10785,7 @@ "value": "32229" }, { - "description": "Sanitary Paper Product Manufacturing ", + "description": "Sanitary Paper Product Manufacturing", "related": [ { "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", @@ -10799,7 +10799,7 @@ "value": "322291" }, { - "description": "All Other Converted Paper Product Manufacturing ", + "description": "All Other Converted Paper Product Manufacturing", "related": [ { "dest-uuid": "f02f313d-3d45-4f45-ac0a-1bc48d42cead", @@ -10897,7 +10897,7 @@ "value": "32311" }, { - "description": "Commercial Printing (except Screen and Books) ", + "description": "Commercial Printing (except Screen and Books)", "related": [ { "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", @@ -10911,7 +10911,7 @@ "value": "323111" }, { - "description": "Commercial Screen Printing ", + "description": "Commercial Screen Printing", "related": [ { "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", @@ -10925,7 +10925,7 @@ "value": "323113" }, { - "description": "Books Printing ", + "description": "Books Printing", "related": [ { "dest-uuid": "a0fce97a-78bf-40ba-82ac-8f276f4ecc4f", @@ -11121,7 +11121,7 @@ "value": "32412" }, { - "description": "Asphalt Paving Mixture and Block Manufacturing ", + "description": "Asphalt Paving Mixture and Block Manufacturing", "related": [ { "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", @@ -11135,7 +11135,7 @@ "value": "324121" }, { - "description": "Asphalt Shingle and Coating Materials Manufacturing ", + "description": "Asphalt Shingle and Coating Materials Manufacturing", "related": [ { "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", @@ -11163,7 +11163,7 @@ "value": "32419" }, { - "description": "Petroleum Lubricating Oil and Grease Manufacturing ", + "description": "Petroleum Lubricating Oil and Grease Manufacturing", "related": [ { "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", @@ -11177,7 +11177,7 @@ "value": "324191" }, { - "description": "All Other Petroleum and Coal Products Manufacturing ", + "description": "All Other Petroleum and Coal Products Manufacturing", "related": [ { "dest-uuid": "c0e62fcf-4ae3-4044-9498-147ec7c0d0cf", @@ -11492,7 +11492,7 @@ "value": "32518" }, { - "description": "Other Basic Inorganic Chemical Manufacturing ", + "description": "Other Basic Inorganic Chemical Manufacturing", "related": [ { "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", @@ -11527,7 +11527,7 @@ "value": "32519" }, { - "description": "Ethyl Alcohol Manufacturing ", + "description": "Ethyl Alcohol Manufacturing", "related": [ { "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", @@ -11541,7 +11541,7 @@ "value": "325193" }, { - "description": "Cyclic Crude, Intermediate, and Gum and Wood Chemical Manufacturing ", + "description": "Cyclic Crude, Intermediate, and Gum and Wood Chemical Manufacturing", "related": [ { "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", @@ -11555,7 +11555,7 @@ "value": "325194" }, { - "description": "All Other Basic Organic Chemical Manufacturing ", + "description": "All Other Basic Organic Chemical Manufacturing", "related": [ { "dest-uuid": "016229a9-2f88-474e-af04-a5cf8213cdc4", @@ -11632,7 +11632,7 @@ "value": "32521" }, { - "description": "Plastics Material and Resin Manufacturing ", + "description": "Plastics Material and Resin Manufacturing", "related": [ { "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", @@ -11646,7 +11646,7 @@ "value": "325211" }, { - "description": "Synthetic Rubber Manufacturing ", + "description": "Synthetic Rubber Manufacturing", "related": [ { "dest-uuid": "a9b4a5df-d66e-4b28-a8f2-493ddcaf4f59", @@ -11779,7 +11779,7 @@ "value": "32531" }, { - "description": "Nitrogenous Fertilizer Manufacturing ", + "description": "Nitrogenous Fertilizer Manufacturing", "related": [ { "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", @@ -11793,7 +11793,7 @@ "value": "325311" }, { - "description": "Phosphatic Fertilizer Manufacturing ", + "description": "Phosphatic Fertilizer Manufacturing", "related": [ { "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", @@ -11807,7 +11807,7 @@ "value": "325312" }, { - "description": "Fertilizer (Mixing Only) Manufacturing ", + "description": "Fertilizer (Mixing Only) Manufacturing", "related": [ { "dest-uuid": "a25fbbca-5ba7-412f-aa38-8a096d984b21", @@ -11940,7 +11940,7 @@ "value": "32541" }, { - "description": "Medicinal and Botanical Manufacturing ", + "description": "Medicinal and Botanical Manufacturing", "related": [ { "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", @@ -11954,7 +11954,7 @@ "value": "325411" }, { - "description": "Pharmaceutical Preparation Manufacturing ", + "description": "Pharmaceutical Preparation Manufacturing", "related": [ { "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", @@ -11968,7 +11968,7 @@ "value": "325412" }, { - "description": "In-Vitro Diagnostic Substance Manufacturing ", + "description": "In-Vitro Diagnostic Substance Manufacturing", "related": [ { "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", @@ -11982,7 +11982,7 @@ "value": "325413" }, { - "description": "Biological Product (except Diagnostic) Manufacturing ", + "description": "Biological Product (except Diagnostic) Manufacturing", "related": [ { "dest-uuid": "c5132750-56e9-48f4-b80f-825b78fc2afa", @@ -12192,7 +12192,7 @@ "value": "32561" }, { - "description": "Soap and Other Detergent Manufacturing ", + "description": "Soap and Other Detergent Manufacturing", "related": [ { "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", @@ -12206,7 +12206,7 @@ "value": "325611" }, { - "description": "Polish and Other Sanitation Good Manufacturing ", + "description": "Polish and Other Sanitation Good Manufacturing", "related": [ { "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", @@ -12220,7 +12220,7 @@ "value": "325612" }, { - "description": "Surface Active Agent Manufacturing ", + "description": "Surface Active Agent Manufacturing", "related": [ { "dest-uuid": "1ca7edf3-1157-4cc2-a37e-e45f87a8d13d", @@ -12444,7 +12444,7 @@ "value": "32599" }, { - "description": "Custom Compounding of Purchased Resins ", + "description": "Custom Compounding of Purchased Resins", "related": [ { "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", @@ -12458,7 +12458,7 @@ "value": "325991" }, { - "description": "Photographic Film, Paper, Plate, Chemical, and Copy Toner Manufacturing ", + "description": "Photographic Film, Paper, Plate, Chemical, and Copy Toner Manufacturing", "related": [ { "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", @@ -12472,7 +12472,7 @@ "value": "325992" }, { - "description": "All Other Miscellaneous Chemical Product and Preparation Manufacturing ", + "description": "All Other Miscellaneous Chemical Product and Preparation Manufacturing", "related": [ { "dest-uuid": "7d5b7fef-1196-43c0-ade5-ff416756262c", @@ -12661,7 +12661,7 @@ "value": "32611" }, { - "description": "Plastics Bag and Pouch Manufacturing ", + "description": "Plastics Bag and Pouch Manufacturing", "related": [ { "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", @@ -12675,7 +12675,7 @@ "value": "326111" }, { - "description": "Plastics Packaging Film and Sheet (including Laminated) Manufacturing ", + "description": "Plastics Packaging Film and Sheet (including Laminated) Manufacturing", "related": [ { "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", @@ -12689,7 +12689,7 @@ "value": "326112" }, { - "description": "Unlaminated Plastics Film and Sheet (except Packaging) Manufacturing ", + "description": "Unlaminated Plastics Film and Sheet (except Packaging) Manufacturing", "related": [ { "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", @@ -12717,7 +12717,7 @@ "value": "32612" }, { - "description": "Unlaminated Plastics Profile Shape Manufacturing ", + "description": "Unlaminated Plastics Profile Shape Manufacturing", "related": [ { "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", @@ -12731,7 +12731,7 @@ "value": "326121" }, { - "description": "Plastics Pipe and Pipe Fitting Manufacturing ", + "description": "Plastics Pipe and Pipe Fitting Manufacturing", "related": [ { "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", @@ -12927,7 +12927,7 @@ "value": "32619" }, { - "description": "Plastics Plumbing Fixture Manufacturing ", + "description": "Plastics Plumbing Fixture Manufacturing", "related": [ { "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", @@ -12941,7 +12941,7 @@ "value": "326191" }, { - "description": "All Other Plastics Product Manufacturing ", + "description": "All Other Plastics Product Manufacturing", "related": [ { "dest-uuid": "7f7d763b-780d-498f-a335-6e20c4ecdb98", @@ -13039,7 +13039,7 @@ "value": "32621" }, { - "description": "Tire Manufacturing (except Retreading) ", + "description": "Tire Manufacturing (except Retreading)", "related": [ { "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", @@ -13053,7 +13053,7 @@ "value": "326211" }, { - "description": "Tire Retreading ", + "description": "Tire Retreading", "related": [ { "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", @@ -13123,7 +13123,7 @@ "value": "32629" }, { - "description": "Rubber Product Manufacturing for Mechanical Use ", + "description": "Rubber Product Manufacturing for Mechanical Use", "related": [ { "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", @@ -13137,7 +13137,7 @@ "value": "326291" }, { - "description": "All Other Rubber Product Manufacturing ", + "description": "All Other Rubber Product Manufacturing", "related": [ { "dest-uuid": "d977c7c0-7d1c-483a-aedd-3f50e60e7fb8", @@ -13256,7 +13256,7 @@ "value": "32711" }, { - "description": "Pottery, Ceramics, and Plumbing Fixture Manufacturing ", + "description": "Pottery, Ceramics, and Plumbing Fixture Manufacturing", "related": [ { "dest-uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", @@ -13298,7 +13298,7 @@ "value": "32712" }, { - "description": "Clay Building Material and Refractories Manufacturing ", + "description": "Clay Building Material and Refractories Manufacturing", "related": [ { "dest-uuid": "8456e2e8-fd56-428b-9028-d40687790e8a", @@ -13382,7 +13382,7 @@ "value": "32721" }, { - "description": "Flat Glass Manufacturing ", + "description": "Flat Glass Manufacturing", "related": [ { "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", @@ -13396,7 +13396,7 @@ "value": "327211" }, { - "description": "Other Pressed and Blown Glass and Glassware Manufacturing ", + "description": "Other Pressed and Blown Glass and Glassware Manufacturing", "related": [ { "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", @@ -13410,7 +13410,7 @@ "value": "327212" }, { - "description": "Glass Container Manufacturing ", + "description": "Glass Container Manufacturing", "related": [ { "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", @@ -13424,7 +13424,7 @@ "value": "327213" }, { - "description": "Glass Product Manufacturing Made of Purchased Glass ", + "description": "Glass Product Manufacturing Made of Purchased Glass", "related": [ { "dest-uuid": "7ea86dd4-179f-470a-938d-70f874fb3f7c", @@ -13613,7 +13613,7 @@ "value": "32733" }, { - "description": "Concrete Block and Brick Manufacturing ", + "description": "Concrete Block and Brick Manufacturing", "related": [ { "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", @@ -13627,7 +13627,7 @@ "value": "327331" }, { - "description": "Concrete Pipe Manufacturing ", + "description": "Concrete Pipe Manufacturing", "related": [ { "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", @@ -13662,7 +13662,7 @@ "value": "32739" }, { - "description": "Other Concrete Product Manufacturing ", + "description": "Other Concrete Product Manufacturing", "related": [ { "dest-uuid": "5a834948-868e-4c5b-b2c1-a431438a49a8", @@ -13928,7 +13928,7 @@ "value": "32799" }, { - "description": "Cut Stone and Stone Product Manufacturing ", + "description": "Cut Stone and Stone Product Manufacturing", "related": [ { "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", @@ -13942,7 +13942,7 @@ "value": "327991" }, { - "description": "Ground or Treated Mineral and Earth Manufacturing ", + "description": "Ground or Treated Mineral and Earth Manufacturing", "related": [ { "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", @@ -13956,7 +13956,7 @@ "value": "327992" }, { - "description": "Mineral Wool Manufacturing ", + "description": "Mineral Wool Manufacturing", "related": [ { "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", @@ -13970,7 +13970,7 @@ "value": "327993" }, { - "description": "All Other Miscellaneous Nonmetallic Mineral Product Manufacturing ", + "description": "All Other Miscellaneous Nonmetallic Mineral Product Manufacturing", "related": [ { "dest-uuid": "8a414b8e-d970-4cc7-ab9e-f8257965b2ff", @@ -14075,7 +14075,7 @@ "value": "33111" }, { - "description": "Iron and Steel Mills and Ferroalloy Manufacturing ", + "description": "Iron and Steel Mills and Ferroalloy Manufacturing", "related": [ { "dest-uuid": "4a48a8c9-f378-449b-9d06-f921f8a75726", @@ -14201,7 +14201,7 @@ "value": "33122" }, { - "description": "Rolled Steel Shape Manufacturing ", + "description": "Rolled Steel Shape Manufacturing", "related": [ { "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", @@ -14215,7 +14215,7 @@ "value": "331221" }, { - "description": "Steel Wire Drawing ", + "description": "Steel Wire Drawing", "related": [ { "dest-uuid": "eb97ab7e-a3a6-4fbe-bcd3-28237e666e71", @@ -14292,7 +14292,7 @@ "value": "33131" }, { - "description": "Alumina Refining and Primary Aluminum Production ", + "description": "Alumina Refining and Primary Aluminum Production", "related": [ { "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", @@ -14306,7 +14306,7 @@ "value": "331313" }, { - "description": "Secondary Smelting and Alloying of Aluminum ", + "description": "Secondary Smelting and Alloying of Aluminum", "related": [ { "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", @@ -14320,7 +14320,7 @@ "value": "331314" }, { - "description": "Aluminum Sheet, Plate, and Foil Manufacturing ", + "description": "Aluminum Sheet, Plate, and Foil Manufacturing", "related": [ { "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", @@ -14334,7 +14334,7 @@ "value": "331315" }, { - "description": "Other Aluminum Rolling, Drawing, and Extruding ", + "description": "Other Aluminum Rolling, Drawing, and Extruding", "related": [ { "dest-uuid": "f569a23b-df7f-4eef-9cdb-f4bf0d39c6c6", @@ -14432,7 +14432,7 @@ "value": "33141" }, { - "description": "Nonferrous Metal (except Aluminum) Smelting and Refining ", + "description": "Nonferrous Metal (except Aluminum) Smelting and Refining", "related": [ { "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", @@ -14509,7 +14509,7 @@ "value": "33149" }, { - "description": "Nonferrous Metal (except Copper and Aluminum) Rolling, Drawing, and Extruding ", + "description": "Nonferrous Metal (except Copper and Aluminum) Rolling, Drawing, and Extruding", "related": [ { "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", @@ -14523,7 +14523,7 @@ "value": "331491" }, { - "description": "Secondary Smelting, Refining, and Alloying of Nonferrous Metal (except Copper and Aluminum) ", + "description": "Secondary Smelting, Refining, and Alloying of Nonferrous Metal (except Copper and Aluminum)", "related": [ { "dest-uuid": "2db6910e-9545-4884-9aa3-3a4eb762893a", @@ -14621,7 +14621,7 @@ "value": "33151" }, { - "description": "Iron Foundries ", + "description": "Iron Foundries", "related": [ { "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", @@ -14635,7 +14635,7 @@ "value": "331511" }, { - "description": "Steel Investment Foundries ", + "description": "Steel Investment Foundries", "related": [ { "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", @@ -14649,7 +14649,7 @@ "value": "331512" }, { - "description": "Steel Foundries (except Investment) ", + "description": "Steel Foundries (except Investment)", "related": [ { "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", @@ -14677,7 +14677,7 @@ "value": "33152" }, { - "description": "Nonferrous Metal Die-Casting Foundries ", + "description": "Nonferrous Metal Die-Casting Foundries", "related": [ { "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", @@ -14691,7 +14691,7 @@ "value": "331523" }, { - "description": "Aluminum Foundries (except Die-Casting) ", + "description": "Aluminum Foundries (except Die-Casting)", "related": [ { "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", @@ -14705,7 +14705,7 @@ "value": "331524" }, { - "description": "Other Nonferrous Metal Foundries (except Die-Casting) ", + "description": "Other Nonferrous Metal Foundries (except Die-Casting)", "related": [ { "dest-uuid": "c57a3e9b-d615-4e65-930a-34d503a4cb9d", @@ -14859,7 +14859,7 @@ "value": "33211" }, { - "description": "Iron and Steel Forging ", + "description": "Iron and Steel Forging", "related": [ { "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", @@ -14873,7 +14873,7 @@ "value": "332111" }, { - "description": "Nonferrous Forging ", + "description": "Nonferrous Forging", "related": [ { "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", @@ -14887,7 +14887,7 @@ "value": "332112" }, { - "description": "Custom Roll Forming ", + "description": "Custom Roll Forming", "related": [ { "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", @@ -14901,7 +14901,7 @@ "value": "332114" }, { - "description": "Powder Metallurgy Part Manufacturing ", + "description": "Powder Metallurgy Part Manufacturing", "related": [ { "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", @@ -14915,7 +14915,7 @@ "value": "332117" }, { - "description": "Metal Crown, Closure, and Other Metal Stamping (except Automotive) ", + "description": "Metal Crown, Closure, and Other Metal Stamping (except Automotive)", "related": [ { "dest-uuid": "4de0883e-2742-498d-9338-6529cc11a219", @@ -14978,7 +14978,7 @@ "value": "33221" }, { - "description": "Metal Kitchen Cookware, Utensil, Cutlery, and Flatware (except Precious) Manufacturing ", + "description": "Metal Kitchen Cookware, Utensil, Cutlery, and Flatware (except Precious) Manufacturing", "related": [ { "dest-uuid": "d302c854-4c56-4876-ac7a-e1b73ba7ac21", @@ -14992,7 +14992,7 @@ "value": "332215" }, { - "description": "Saw Blade and Handtool Manufacturing ", + "description": "Saw Blade and Handtool Manufacturing", "related": [ { "dest-uuid": "d302c854-4c56-4876-ac7a-e1b73ba7ac21", @@ -15090,7 +15090,7 @@ "value": "33231" }, { - "description": "Prefabricated Metal Building and Component Manufacturing ", + "description": "Prefabricated Metal Building and Component Manufacturing", "related": [ { "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", @@ -15104,7 +15104,7 @@ "value": "332311" }, { - "description": "Fabricated Structural Metal Manufacturing ", + "description": "Fabricated Structural Metal Manufacturing", "related": [ { "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", @@ -15118,7 +15118,7 @@ "value": "332312" }, { - "description": "Plate Work Manufacturing ", + "description": "Plate Work Manufacturing", "related": [ { "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", @@ -15146,7 +15146,7 @@ "value": "33232" }, { - "description": "Metal Window and Door Manufacturing ", + "description": "Metal Window and Door Manufacturing", "related": [ { "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", @@ -15160,7 +15160,7 @@ "value": "332321" }, { - "description": "Sheet Metal Work Manufacturing ", + "description": "Sheet Metal Work Manufacturing", "related": [ { "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", @@ -15174,7 +15174,7 @@ "value": "332322" }, { - "description": "Ornamental and Architectural Metal Work Manufacturing ", + "description": "Ornamental and Architectural Metal Work Manufacturing", "related": [ { "dest-uuid": "d55bffa2-5d24-44ba-945a-c32e6f7d20a7", @@ -15349,7 +15349,7 @@ "value": "33243" }, { - "description": "Metal Can Manufacturing ", + "description": "Metal Can Manufacturing", "related": [ { "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", @@ -15363,7 +15363,7 @@ "value": "332431" }, { - "description": "Other Metal Container Manufacturing ", + "description": "Other Metal Container Manufacturing", "related": [ { "dest-uuid": "ce9d6d87-4d24-4989-b6b5-8d06ea0fb8a1", @@ -15496,7 +15496,7 @@ "value": "33261" }, { - "description": "Spring Manufacturing ", + "description": "Spring Manufacturing", "related": [ { "dest-uuid": "29117540-f6d6-40a4-b44c-d0cc154aad07", @@ -15510,7 +15510,7 @@ "value": "332613" }, { - "description": "Other Fabricated Wire Product Manufacturing ", + "description": "Other Fabricated Wire Product Manufacturing", "related": [ { "dest-uuid": "29117540-f6d6-40a4-b44c-d0cc154aad07", @@ -15629,7 +15629,7 @@ "value": "33272" }, { - "description": "Precision Turned Product Manufacturing ", + "description": "Precision Turned Product Manufacturing", "related": [ { "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", @@ -15643,7 +15643,7 @@ "value": "332721" }, { - "description": "Bolt, Nut, Screw, Rivet, and Washer Manufacturing ", + "description": "Bolt, Nut, Screw, Rivet, and Washer Manufacturing", "related": [ { "dest-uuid": "834f2b3a-3dcb-43cd-b898-55a54bc08b16", @@ -15713,7 +15713,7 @@ "value": "33281" }, { - "description": "Metal Heat Treating ", + "description": "Metal Heat Treating", "related": [ { "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", @@ -15727,7 +15727,7 @@ "value": "332811" }, { - "description": "Metal Coating, Engraving (except Jewelry and Silverware), and Allied Services to Manufacturers ", + "description": "Metal Coating, Engraving (except Jewelry and Silverware), and Allied Services to Manufacturers", "related": [ { "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", @@ -15741,7 +15741,7 @@ "value": "332812" }, { - "description": "Electroplating, Plating, Polishing, Anodizing, and Coloring ", + "description": "Electroplating, Plating, Polishing, Anodizing, and Coloring", "related": [ { "dest-uuid": "52df7d22-fc2c-4b52-9815-e28f39e249f4", @@ -15867,7 +15867,7 @@ "value": "33291" }, { - "description": "Industrial Valve Manufacturing ", + "description": "Industrial Valve Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -15881,7 +15881,7 @@ "value": "332911" }, { - "description": "Fluid Power Valve and Hose Fitting Manufacturing ", + "description": "Fluid Power Valve and Hose Fitting Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -15895,7 +15895,7 @@ "value": "332912" }, { - "description": "Plumbing Fixture Fitting and Trim Manufacturing ", + "description": "Plumbing Fixture Fitting and Trim Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -15909,7 +15909,7 @@ "value": "332913" }, { - "description": "Other Metal Valve and Pipe Fitting Manufacturing ", + "description": "Other Metal Valve and Pipe Fitting Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -15951,7 +15951,7 @@ "value": "332991" }, { - "description": "Small Arms Ammunition Manufacturing ", + "description": "Small Arms Ammunition Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -15965,7 +15965,7 @@ "value": "332992" }, { - "description": "Ammunition (except Small Arms) Manufacturing ", + "description": "Ammunition (except Small Arms) Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -15979,7 +15979,7 @@ "value": "332993" }, { - "description": "Small Arms, Ordnance, and Ordnance Accessories Manufacturing ", + "description": "Small Arms, Ordnance, and Ordnance Accessories Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -15993,7 +15993,7 @@ "value": "332994" }, { - "description": "Fabricated Pipe and Pipe Fitting Manufacturing ", + "description": "Fabricated Pipe and Pipe Fitting Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -16007,7 +16007,7 @@ "value": "332996" }, { - "description": "All Other Miscellaneous Fabricated Metal Product Manufacturing ", + "description": "All Other Miscellaneous Fabricated Metal Product Manufacturing", "related": [ { "dest-uuid": "c1ee5231-4cba-4587-a51b-f94dcec407f6", @@ -16161,7 +16161,7 @@ "value": "33311" }, { - "description": "Farm Machinery and Equipment Manufacturing ", + "description": "Farm Machinery and Equipment Manufacturing", "related": [ { "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", @@ -16175,7 +16175,7 @@ "value": "333111" }, { - "description": "Lawn and Garden Tractor and Home Lawn and Garden Equipment Manufacturing ", + "description": "Lawn and Garden Tractor and Home Lawn and Garden Equipment Manufacturing", "related": [ { "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", @@ -16245,7 +16245,7 @@ "value": "33313" }, { - "description": "Mining Machinery and Equipment Manufacturing ", + "description": "Mining Machinery and Equipment Manufacturing", "related": [ { "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", @@ -16259,7 +16259,7 @@ "value": "333131" }, { - "description": "Oil and Gas Field Machinery and Equipment Manufacturing ", + "description": "Oil and Gas Field Machinery and Equipment Manufacturing", "related": [ { "dest-uuid": "dc980fd5-76da-490a-99bf-cede45749acd", @@ -16336,7 +16336,7 @@ "value": "33324" }, { - "description": "Food Product Machinery Manufacturing ", + "description": "Food Product Machinery Manufacturing", "related": [ { "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", @@ -16350,7 +16350,7 @@ "value": "333241" }, { - "description": "Semiconductor Machinery Manufacturing ", + "description": "Semiconductor Machinery Manufacturing", "related": [ { "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", @@ -16364,7 +16364,7 @@ "value": "333242" }, { - "description": "Sawmill, Woodworking, and Paper Machinery Manufacturing ", + "description": "Sawmill, Woodworking, and Paper Machinery Manufacturing", "related": [ { "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", @@ -16378,7 +16378,7 @@ "value": "333243" }, { - "description": "All Other Industrial Machinery Manufacturing ", + "description": "All Other Industrial Machinery Manufacturing", "related": [ { "dest-uuid": "6da45fb4-2580-4e3f-b8be-aab908e19f4a", @@ -16441,7 +16441,7 @@ "value": "33331" }, { - "description": "Commercial and Service Industry Machinery Manufacturing ", + "description": "Commercial and Service Industry Machinery Manufacturing", "related": [ { "dest-uuid": "cc8fb95f-3953-4fba-90ca-30da5d0a1f78", @@ -16518,7 +16518,7 @@ "value": "33341" }, { - "description": "Industrial and Commercial Fan and Blower and Air Purification Equipment Manufacturing ", + "description": "Industrial and Commercial Fan and Blower and Air Purification Equipment Manufacturing", "related": [ { "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", @@ -16532,7 +16532,7 @@ "value": "333413" }, { - "description": "Heating Equipment (except Warm Air Furnaces) Manufacturing ", + "description": "Heating Equipment (except Warm Air Furnaces) Manufacturing", "related": [ { "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", @@ -16546,7 +16546,7 @@ "value": "333414" }, { - "description": "Air-Conditioning and Warm Air Heating Equipment and Commercial and Industrial Refrigeration Equipment Manufacturing ", + "description": "Air-Conditioning and Warm Air Heating Equipment and Commercial and Industrial Refrigeration Equipment Manufacturing", "related": [ { "dest-uuid": "d8232281-6076-4b2f-83df-bebffbd31695", @@ -16630,7 +16630,7 @@ "value": "33351" }, { - "description": "Industrial Mold Manufacturing ", + "description": "Industrial Mold Manufacturing", "related": [ { "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", @@ -16644,7 +16644,7 @@ "value": "333511" }, { - "description": "Special Die and Tool, Die Set, Jig, and Fixture Manufacturing ", + "description": "Special Die and Tool, Die Set, Jig, and Fixture Manufacturing", "related": [ { "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", @@ -16658,7 +16658,7 @@ "value": "333514" }, { - "description": "Cutting Tool and Machine Tool Accessory Manufacturing ", + "description": "Cutting Tool and Machine Tool Accessory Manufacturing", "related": [ { "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", @@ -16672,7 +16672,7 @@ "value": "333515" }, { - "description": "Machine Tool Manufacturing ", + "description": "Machine Tool Manufacturing", "related": [ { "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", @@ -16686,7 +16686,7 @@ "value": "333517" }, { - "description": "Rolling Mill and Other Metalworking Machinery Manufacturing ", + "description": "Rolling Mill and Other Metalworking Machinery Manufacturing", "related": [ { "dest-uuid": "9805eb27-c1b1-4104-97f4-f3c5ff7665ce", @@ -16763,7 +16763,7 @@ "value": "33361" }, { - "description": "Turbine and Turbine Generator Set Units Manufacturing ", + "description": "Turbine and Turbine Generator Set Units Manufacturing", "related": [ { "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", @@ -16777,7 +16777,7 @@ "value": "333611" }, { - "description": "Speed Changer, Industrial High-Speed Drive, and Gear Manufacturing ", + "description": "Speed Changer, Industrial High-Speed Drive, and Gear Manufacturing", "related": [ { "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", @@ -16791,7 +16791,7 @@ "value": "333612" }, { - "description": "Mechanical Power Transmission Equipment Manufacturing ", + "description": "Mechanical Power Transmission Equipment Manufacturing", "related": [ { "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", @@ -16805,7 +16805,7 @@ "value": "333613" }, { - "description": "Other Engine Equipment Manufacturing ", + "description": "Other Engine Equipment Manufacturing", "related": [ { "dest-uuid": "f9e5beca-944c-41d2-9c1b-cfba2be96489", @@ -16959,7 +16959,7 @@ "value": "33391" }, { - "description": "Air and Gas Compressor Manufacturing ", + "description": "Air and Gas Compressor Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -16973,7 +16973,7 @@ "value": "333912" }, { - "description": "Measuring, Dispensing, and Other Pumping Equipment Manufacturing ", + "description": "Measuring, Dispensing, and Other Pumping Equipment Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17001,7 +17001,7 @@ "value": "33392" }, { - "description": "Elevator and Moving Stairway Manufacturing ", + "description": "Elevator and Moving Stairway Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17015,7 +17015,7 @@ "value": "333921" }, { - "description": "Conveyor and Conveying Equipment Manufacturing ", + "description": "Conveyor and Conveying Equipment Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17029,7 +17029,7 @@ "value": "333922" }, { - "description": "Overhead Traveling Crane, Hoist, and Monorail System Manufacturing ", + "description": "Overhead Traveling Crane, Hoist, and Monorail System Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17043,7 +17043,7 @@ "value": "333923" }, { - "description": "Industrial Truck, Tractor, Trailer, and Stacker Machinery Manufacturing ", + "description": "Industrial Truck, Tractor, Trailer, and Stacker Machinery Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17071,7 +17071,7 @@ "value": "33399" }, { - "description": "Power-Driven Handtool Manufacturing ", + "description": "Power-Driven Handtool Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17085,7 +17085,7 @@ "value": "333991" }, { - "description": "Welding and Soldering Equipment Manufacturing ", + "description": "Welding and Soldering Equipment Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17099,7 +17099,7 @@ "value": "333992" }, { - "description": "Packaging Machinery Manufacturing ", + "description": "Packaging Machinery Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17113,7 +17113,7 @@ "value": "333993" }, { - "description": "Industrial Process Furnace and Oven Manufacturing ", + "description": "Industrial Process Furnace and Oven Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17127,7 +17127,7 @@ "value": "333994" }, { - "description": "Fluid Power Cylinder and Actuator Manufacturing ", + "description": "Fluid Power Cylinder and Actuator Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17141,7 +17141,7 @@ "value": "333995" }, { - "description": "Fluid Power Pump and Motor Manufacturing ", + "description": "Fluid Power Pump and Motor Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17155,7 +17155,7 @@ "value": "333996" }, { - "description": "All Other Miscellaneous General Purpose Machinery Manufacturing ", + "description": "All Other Miscellaneous General Purpose Machinery Manufacturing", "related": [ { "dest-uuid": "6d167669-f172-4f38-b097-f7102d8531e8", @@ -17274,7 +17274,7 @@ "value": "33411" }, { - "description": "Electronic Computer Manufacturing ", + "description": "Electronic Computer Manufacturing", "related": [ { "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", @@ -17288,7 +17288,7 @@ "value": "334111" }, { - "description": "Computer Storage Device Manufacturing ", + "description": "Computer Storage Device Manufacturing", "related": [ { "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", @@ -17302,7 +17302,7 @@ "value": "334112" }, { - "description": "Computer Terminal and Other Computer Peripheral Equipment Manufacturing ", + "description": "Computer Terminal and Other Computer Peripheral Equipment Manufacturing", "related": [ { "dest-uuid": "b5758617-ad33-48cb-8eb1-a354ddb73dd1", @@ -17645,7 +17645,7 @@ "value": "33441" }, { - "description": "Bare Printed Circuit Board Manufacturing ", + "description": "Bare Printed Circuit Board Manufacturing", "related": [ { "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", @@ -17659,7 +17659,7 @@ "value": "334412" }, { - "description": "Semiconductor and Related Device Manufacturing ", + "description": "Semiconductor and Related Device Manufacturing", "related": [ { "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", @@ -17673,7 +17673,7 @@ "value": "334413" }, { - "description": "Capacitor, Resistor, Coil, Transformer, and Other Inductor Manufacturing ", + "description": "Capacitor, Resistor, Coil, Transformer, and Other Inductor Manufacturing", "related": [ { "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", @@ -17687,7 +17687,7 @@ "value": "334416" }, { - "description": "Electronic Connector Manufacturing ", + "description": "Electronic Connector Manufacturing", "related": [ { "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", @@ -17701,7 +17701,7 @@ "value": "334417" }, { - "description": "Printed Circuit Assembly (Electronic Assembly) Manufacturing ", + "description": "Printed Circuit Assembly (Electronic Assembly) Manufacturing", "related": [ { "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", @@ -17715,7 +17715,7 @@ "value": "334418" }, { - "description": "Other Electronic Component Manufacturing ", + "description": "Other Electronic Component Manufacturing", "related": [ { "dest-uuid": "47ab3791-a7d6-4cc6-b8d6-af589d5bd981", @@ -17834,7 +17834,7 @@ "value": "33451" }, { - "description": "Electromedical and Electrotherapeutic Apparatus Manufacturing ", + "description": "Electromedical and Electrotherapeutic Apparatus Manufacturing", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17855,7 +17855,7 @@ "value": "334510" }, { - "description": "Search, Detection, Navigation, Guidance, Aeronautical, and Nautical System and Instrument Manufacturing ", + "description": "Search, Detection, Navigation, Guidance, Aeronautical, and Nautical System and Instrument Manufacturing", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17869,7 +17869,7 @@ "value": "334511" }, { - "description": "Automatic Environmental Control Manufacturing for Residential, Commercial, and Appliance Use ", + "description": "Automatic Environmental Control Manufacturing for Residential, Commercial, and Appliance Use", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17883,7 +17883,7 @@ "value": "334512" }, { - "description": "Instruments and Related Products Manufacturing for Measuring, Displaying, and Controlling Industrial Process Variables ", + "description": "Instruments and Related Products Manufacturing for Measuring, Displaying, and Controlling Industrial Process Variables", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17897,7 +17897,7 @@ "value": "334513" }, { - "description": "Totalizing Fluid Meter and Counting Device Manufacturing ", + "description": "Totalizing Fluid Meter and Counting Device Manufacturing", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17911,7 +17911,7 @@ "value": "334514" }, { - "description": "Instrument Manufacturing for Measuring and Testing Electricity and Electrical Signals ", + "description": "Instrument Manufacturing for Measuring and Testing Electricity and Electrical Signals", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17925,7 +17925,7 @@ "value": "334515" }, { - "description": "Analytical Laboratory Instrument Manufacturing ", + "description": "Analytical Laboratory Instrument Manufacturing", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17939,7 +17939,7 @@ "value": "334516" }, { - "description": "Irradiation Apparatus Manufacturing ", + "description": "Irradiation Apparatus Manufacturing", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -17953,7 +17953,7 @@ "value": "334517" }, { - "description": "Other Measuring and Controlling Device Manufacturing ", + "description": "Other Measuring and Controlling Device Manufacturing", "related": [ { "dest-uuid": "62702a46-2492-4ef2-983e-141409d37fef", @@ -18016,7 +18016,7 @@ "value": "33461" }, { - "description": "Manufacturing and Reproducing Magnetic and Optical Media ", + "description": "Manufacturing and Reproducing Magnetic and Optical Media", "related": [ { "dest-uuid": "bf9483a5-95dc-409a-bdb7-fd19148259f9", @@ -18128,7 +18128,7 @@ "value": "33513" }, { - "description": "Residential Electric Lighting Fixture Manufacturing ", + "description": "Residential Electric Lighting Fixture Manufacturing", "related": [ { "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", @@ -18142,7 +18142,7 @@ "value": "335131" }, { - "description": "Commercial, Industrial, and Institutional Electric Lighting Fixture Manufacturing ", + "description": "Commercial, Industrial, and Institutional Electric Lighting Fixture Manufacturing", "related": [ { "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", @@ -18156,7 +18156,7 @@ "value": "335132" }, { - "description": "Electric Lamp Bulb and Other Lighting Equipment Manufacturing ", + "description": "Electric Lamp Bulb and Other Lighting Equipment Manufacturing", "related": [ { "dest-uuid": "342cc4e3-0b7d-4cd4-8ca3-914ac39a0c00", @@ -18254,7 +18254,7 @@ "value": "335210" }, { - "description": "Major Household Appliance Manufacturing ", + "description": "Major Household Appliance Manufacturing", "related": [ { "dest-uuid": "475d454c-8cab-4bac-977e-0465be40abb1", @@ -18275,7 +18275,7 @@ "value": "33522" }, { - "description": "Major Household Appliance Manufacturing ", + "description": "Major Household Appliance Manufacturing", "related": [ { "dest-uuid": "475d454c-8cab-4bac-977e-0465be40abb1", @@ -18359,7 +18359,7 @@ "value": "33531" }, { - "description": "Power, Distribution, and Specialty Transformer Manufacturing ", + "description": "Power, Distribution, and Specialty Transformer Manufacturing", "related": [ { "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", @@ -18373,7 +18373,7 @@ "value": "335311" }, { - "description": "Motor and Generator Manufacturing ", + "description": "Motor and Generator Manufacturing", "related": [ { "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", @@ -18387,7 +18387,7 @@ "value": "335312" }, { - "description": "Switchgear and Switchboard Apparatus Manufacturing ", + "description": "Switchgear and Switchboard Apparatus Manufacturing", "related": [ { "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", @@ -18401,7 +18401,7 @@ "value": "335313" }, { - "description": "Relay and Industrial Control Manufacturing ", + "description": "Relay and Industrial Control Manufacturing", "related": [ { "dest-uuid": "4a941ab3-d3a4-40ac-a224-02696472ea66", @@ -18527,7 +18527,7 @@ "value": "33591" }, { - "description": "Battery Manufacturing ", + "description": "Battery Manufacturing", "related": [ { "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", @@ -18562,7 +18562,7 @@ "value": "33592" }, { - "description": "Fiber Optic Cable Manufacturing ", + "description": "Fiber Optic Cable Manufacturing", "related": [ { "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", @@ -18576,7 +18576,7 @@ "value": "335921" }, { - "description": "Other Communication and Energy Wire Manufacturing ", + "description": "Other Communication and Energy Wire Manufacturing", "related": [ { "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", @@ -18604,7 +18604,7 @@ "value": "33593" }, { - "description": "Current-Carrying Wiring Device Manufacturing ", + "description": "Current-Carrying Wiring Device Manufacturing", "related": [ { "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", @@ -18618,7 +18618,7 @@ "value": "335931" }, { - "description": "Noncurrent-Carrying Wiring Device Manufacturing ", + "description": "Noncurrent-Carrying Wiring Device Manufacturing", "related": [ { "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", @@ -18646,7 +18646,7 @@ "value": "33599" }, { - "description": "Carbon and Graphite Product Manufacturing ", + "description": "Carbon and Graphite Product Manufacturing", "related": [ { "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", @@ -18660,7 +18660,7 @@ "value": "335991" }, { - "description": "All Other Miscellaneous Electrical Equipment and Component Manufacturing ", + "description": "All Other Miscellaneous Electrical Equipment and Component Manufacturing", "related": [ { "dest-uuid": "98deaafb-12b3-4cf4-9aa0-c23cd71dda88", @@ -18793,7 +18793,7 @@ "value": "33611" }, { - "description": "Automobile and Light Duty Motor Vehicle Manufacturing ", + "description": "Automobile and Light Duty Motor Vehicle Manufacturing", "related": [ { "dest-uuid": "ffed911c-ee44-49fa-9475-5f41c74013f2", @@ -18919,7 +18919,7 @@ "value": "33621" }, { - "description": "Motor Vehicle Body Manufacturing ", + "description": "Motor Vehicle Body Manufacturing", "related": [ { "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", @@ -18933,7 +18933,7 @@ "value": "336211" }, { - "description": "Truck Trailer Manufacturing ", + "description": "Truck Trailer Manufacturing", "related": [ { "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", @@ -18947,7 +18947,7 @@ "value": "336212" }, { - "description": "Motor Home Manufacturing ", + "description": "Motor Home Manufacturing", "related": [ { "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", @@ -18961,7 +18961,7 @@ "value": "336213" }, { - "description": "Travel Trailer and Camper Manufacturing ", + "description": "Travel Trailer and Camper Manufacturing", "related": [ { "dest-uuid": "74f53c69-62b2-4a99-96b2-a474de576021", @@ -19514,7 +19514,7 @@ "value": "33641" }, { - "description": "Aircraft Manufacturing ", + "description": "Aircraft Manufacturing", "related": [ { "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", @@ -19528,7 +19528,7 @@ "value": "336411" }, { - "description": "Aircraft Engine and Engine Parts Manufacturing ", + "description": "Aircraft Engine and Engine Parts Manufacturing", "related": [ { "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", @@ -19542,7 +19542,7 @@ "value": "336412" }, { - "description": "Other Aircraft Parts and Auxiliary Equipment Manufacturing ", + "description": "Other Aircraft Parts and Auxiliary Equipment Manufacturing", "related": [ { "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", @@ -19556,7 +19556,7 @@ "value": "336413" }, { - "description": "Guided Missile and Space Vehicle Manufacturing ", + "description": "Guided Missile and Space Vehicle Manufacturing", "related": [ { "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", @@ -19570,7 +19570,7 @@ "value": "336414" }, { - "description": "Guided Missile and Space Vehicle Propulsion Unit and Propulsion Unit Parts Manufacturing ", + "description": "Guided Missile and Space Vehicle Propulsion Unit and Propulsion Unit Parts Manufacturing", "related": [ { "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", @@ -19584,7 +19584,7 @@ "value": "336415" }, { - "description": "Other Guided Missile and Space Vehicle Parts and Auxiliary Equipment Manufacturing ", + "description": "Other Guided Missile and Space Vehicle Parts and Auxiliary Equipment Manufacturing", "related": [ { "dest-uuid": "88af17b6-458c-4634-bc19-5f97c40ca54c", @@ -19717,7 +19717,7 @@ "value": "33661" }, { - "description": "Ship Building and Repairing ", + "description": "Ship Building and Repairing", "related": [ { "dest-uuid": "b72788bd-024e-4ee3-9ca0-4b7b48960d21", @@ -19731,7 +19731,7 @@ "value": "336611" }, { - "description": "Boat Building ", + "description": "Boat Building", "related": [ { "dest-uuid": "b72788bd-024e-4ee3-9ca0-4b7b48960d21", @@ -19801,7 +19801,7 @@ "value": "33699" }, { - "description": "Motorcycle, Bicycle, and Parts Manufacturing ", + "description": "Motorcycle, Bicycle, and Parts Manufacturing", "related": [ { "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", @@ -19815,7 +19815,7 @@ "value": "336991" }, { - "description": "Military Armored Vehicle, Tank, and Tank Component Manufacturing ", + "description": "Military Armored Vehicle, Tank, and Tank Component Manufacturing", "related": [ { "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", @@ -19829,7 +19829,7 @@ "value": "336992" }, { - "description": "All Other Transportation Equipment Manufacturing ", + "description": "All Other Transportation Equipment Manufacturing", "related": [ { "dest-uuid": "b35590b6-06c0-4bbc-9463-10c8d10a0a29", @@ -19990,7 +19990,7 @@ "value": "33712" }, { - "description": "Upholstered Household Furniture Manufacturing ", + "description": "Upholstered Household Furniture Manufacturing", "related": [ { "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", @@ -20004,7 +20004,7 @@ "value": "337121" }, { - "description": "Nonupholstered Wood Household Furniture Manufacturing ", + "description": "Nonupholstered Wood Household Furniture Manufacturing", "related": [ { "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", @@ -20018,7 +20018,7 @@ "value": "337122" }, { - "description": "Household Furniture (except Wood and Upholstered) Manufacturing ", + "description": "Household Furniture (except Wood and Upholstered) Manufacturing", "related": [ { "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", @@ -20032,7 +20032,7 @@ "value": "337126" }, { - "description": "Institutional Furniture Manufacturing ", + "description": "Institutional Furniture Manufacturing", "related": [ { "dest-uuid": "0711cba7-46c8-46e5-8a20-a4a1e0316c72", @@ -20109,7 +20109,7 @@ "value": "33721" }, { - "description": "Wood Office Furniture Manufacturing ", + "description": "Wood Office Furniture Manufacturing", "related": [ { "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", @@ -20123,7 +20123,7 @@ "value": "337211" }, { - "description": "Custom Architectural Woodwork and Millwork Manufacturing ", + "description": "Custom Architectural Woodwork and Millwork Manufacturing", "related": [ { "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", @@ -20137,7 +20137,7 @@ "value": "337212" }, { - "description": "Office Furniture (except Wood) Manufacturing ", + "description": "Office Furniture (except Wood) Manufacturing", "related": [ { "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", @@ -20151,7 +20151,7 @@ "value": "337214" }, { - "description": "Showcase, Partition, Shelving, and Locker Manufacturing ", + "description": "Showcase, Partition, Shelving, and Locker Manufacturing", "related": [ { "dest-uuid": "f7a8774c-63d1-410b-9c65-d804fb11b355", @@ -20382,7 +20382,7 @@ "value": "33911" }, { - "description": "Surgical and Medical Instrument Manufacturing ", + "description": "Surgical and Medical Instrument Manufacturing", "related": [ { "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", @@ -20396,7 +20396,7 @@ "value": "339112" }, { - "description": "Surgical Appliance and Supplies Manufacturing ", + "description": "Surgical Appliance and Supplies Manufacturing", "related": [ { "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", @@ -20410,7 +20410,7 @@ "value": "339113" }, { - "description": "Dental Equipment and Supplies Manufacturing ", + "description": "Dental Equipment and Supplies Manufacturing", "related": [ { "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", @@ -20424,7 +20424,7 @@ "value": "339114" }, { - "description": "Ophthalmic Goods Manufacturing ", + "description": "Ophthalmic Goods Manufacturing", "related": [ { "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", @@ -20438,7 +20438,7 @@ "value": "339115" }, { - "description": "Dental Laboratories ", + "description": "Dental Laboratories", "related": [ { "dest-uuid": "559cbc50-cfea-4d61-97d8-adf2c17fc914", @@ -20606,7 +20606,7 @@ "value": "33991" }, { - "description": "Jewelry and Silverware Manufacturing ", + "description": "Jewelry and Silverware Manufacturing", "related": [ { "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", @@ -20809,7 +20809,7 @@ "value": "33999" }, { - "description": "Gasket, Packing, and Sealing Device Manufacturing ", + "description": "Gasket, Packing, and Sealing Device Manufacturing", "related": [ { "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", @@ -20823,7 +20823,7 @@ "value": "339991" }, { - "description": "Musical Instrument Manufacturing ", + "description": "Musical Instrument Manufacturing", "related": [ { "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", @@ -20837,7 +20837,7 @@ "value": "339992" }, { - "description": "Fastener, Button, Needle, and Pin Manufacturing ", + "description": "Fastener, Button, Needle, and Pin Manufacturing", "related": [ { "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", @@ -20851,7 +20851,7 @@ "value": "339993" }, { - "description": "Broom, Brush, and Mop Manufacturing ", + "description": "Broom, Brush, and Mop Manufacturing", "related": [ { "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", @@ -20865,7 +20865,7 @@ "value": "339994" }, { - "description": "Burial Casket Manufacturing ", + "description": "Burial Casket Manufacturing", "related": [ { "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", @@ -20879,7 +20879,7 @@ "value": "339995" }, { - "description": "All Other Miscellaneous Manufacturing ", + "description": "All Other Miscellaneous Manufacturing", "related": [ { "dest-uuid": "e9e31c37-4c5c-4157-b28f-cc478f8b8fe3", @@ -20921,7 +20921,7 @@ "value": "42" }, { - "description": "Merchant Wholesalers, Durable Goods ", + "description": "Merchant Wholesalers, Durable Goods", "related": [ { "dest-uuid": "263d2cb5-c44f-4fb5-a5a1-b940375f7a5a", @@ -20998,7 +20998,7 @@ "value": "423" }, { - "description": "Motor Vehicle and Motor Vehicle Parts and Supplies Merchant Wholesalers ", + "description": "Motor Vehicle and Motor Vehicle Parts and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -21068,7 +21068,7 @@ "value": "4231" }, { - "description": "Automobile and Other Motor Vehicle Merchant Wholesalers ", + "description": "Automobile and Other Motor Vehicle Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21089,7 +21089,7 @@ "value": "42311" }, { - "description": "Automobile and Other Motor Vehicle Merchant Wholesalers ", + "description": "Automobile and Other Motor Vehicle Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21110,7 +21110,7 @@ "value": "423110" }, { - "description": "Motor Vehicle Supplies and New Parts Merchant Wholesalers ", + "description": "Motor Vehicle Supplies and New Parts Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21131,7 +21131,7 @@ "value": "42312" }, { - "description": "Motor Vehicle Supplies and New Parts Merchant Wholesalers ", + "description": "Motor Vehicle Supplies and New Parts Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21152,7 +21152,7 @@ "value": "423120" }, { - "description": "Tire and Tube Merchant Wholesalers ", + "description": "Tire and Tube Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21173,7 +21173,7 @@ "value": "42313" }, { - "description": "Tire and Tube Merchant Wholesalers ", + "description": "Tire and Tube Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21194,7 +21194,7 @@ "value": "423130" }, { - "description": "Motor Vehicle Parts (Used) Merchant Wholesalers ", + "description": "Motor Vehicle Parts (Used) Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21215,7 +21215,7 @@ "value": "42314" }, { - "description": "Motor Vehicle Parts (Used) Merchant Wholesalers ", + "description": "Motor Vehicle Parts (Used) Merchant Wholesalers", "related": [ { "dest-uuid": "5d4daf0b-3f3c-404f-99ce-2975cf0e2f07", @@ -21236,7 +21236,7 @@ "value": "423140" }, { - "description": "Furniture and Home Furnishing Merchant Wholesalers ", + "description": "Furniture and Home Furnishing Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -21278,7 +21278,7 @@ "value": "4232" }, { - "description": "Furniture Merchant Wholesalers ", + "description": "Furniture Merchant Wholesalers", "related": [ { "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", @@ -21299,7 +21299,7 @@ "value": "42321" }, { - "description": "Furniture Merchant Wholesalers ", + "description": "Furniture Merchant Wholesalers", "related": [ { "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", @@ -21320,7 +21320,7 @@ "value": "423210" }, { - "description": "Home Furnishing Merchant Wholesalers ", + "description": "Home Furnishing Merchant Wholesalers", "related": [ { "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", @@ -21341,7 +21341,7 @@ "value": "42322" }, { - "description": "Home Furnishing Merchant Wholesalers ", + "description": "Home Furnishing Merchant Wholesalers", "related": [ { "dest-uuid": "1a2de2a5-51cb-4b02-8fed-639cd4fdbfa1", @@ -21362,7 +21362,7 @@ "value": "423220" }, { - "description": "Lumber and Other Construction Materials Merchant Wholesalers ", + "description": "Lumber and Other Construction Materials Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -21432,7 +21432,7 @@ "value": "4233" }, { - "description": "Lumber, Plywood, Millwork, and Wood Panel Merchant Wholesalers ", + "description": "Lumber, Plywood, Millwork, and Wood Panel Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21453,7 +21453,7 @@ "value": "42331" }, { - "description": "Lumber, Plywood, Millwork, and Wood Panel Merchant Wholesalers ", + "description": "Lumber, Plywood, Millwork, and Wood Panel Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21474,7 +21474,7 @@ "value": "423310" }, { - "description": "Brick, Stone, and Related Construction Material Merchant Wholesalers ", + "description": "Brick, Stone, and Related Construction Material Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21495,7 +21495,7 @@ "value": "42332" }, { - "description": "Brick, Stone, and Related Construction Material Merchant Wholesalers ", + "description": "Brick, Stone, and Related Construction Material Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21516,7 +21516,7 @@ "value": "423320" }, { - "description": "Roofing, Siding, and Insulation Material Merchant Wholesalers ", + "description": "Roofing, Siding, and Insulation Material Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21537,7 +21537,7 @@ "value": "42333" }, { - "description": "Roofing, Siding, and Insulation Material Merchant Wholesalers ", + "description": "Roofing, Siding, and Insulation Material Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21558,7 +21558,7 @@ "value": "423330" }, { - "description": "Other Construction Material Merchant Wholesalers ", + "description": "Other Construction Material Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21579,7 +21579,7 @@ "value": "42339" }, { - "description": "Other Construction Material Merchant Wholesalers ", + "description": "Other Construction Material Merchant Wholesalers", "related": [ { "dest-uuid": "07b5638f-0569-4aa0-8069-b7113fe9466e", @@ -21600,7 +21600,7 @@ "value": "423390" }, { - "description": "Professional and Commercial Equipment and Supplies Merchant Wholesalers ", + "description": "Professional and Commercial Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -21712,7 +21712,7 @@ "value": "4234" }, { - "description": "Photographic Equipment and Supplies Merchant Wholesalers ", + "description": "Photographic Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21733,7 +21733,7 @@ "value": "42341" }, { - "description": "Photographic Equipment and Supplies Merchant Wholesalers ", + "description": "Photographic Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21754,7 +21754,7 @@ "value": "423410" }, { - "description": "Office Equipment Merchant Wholesalers ", + "description": "Office Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21775,7 +21775,7 @@ "value": "42342" }, { - "description": "Office Equipment Merchant Wholesalers ", + "description": "Office Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21796,7 +21796,7 @@ "value": "423420" }, { - "description": "Computer and Computer Peripheral Equipment and Software Merchant Wholesalers ", + "description": "Computer and Computer Peripheral Equipment and Software Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21817,7 +21817,7 @@ "value": "42343" }, { - "description": "Computer and Computer Peripheral Equipment and Software Merchant Wholesalers ", + "description": "Computer and Computer Peripheral Equipment and Software Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21838,7 +21838,7 @@ "value": "423430" }, { - "description": "Other Commercial Equipment Merchant Wholesalers ", + "description": "Other Commercial Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21859,7 +21859,7 @@ "value": "42344" }, { - "description": "Other Commercial Equipment Merchant Wholesalers ", + "description": "Other Commercial Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21880,7 +21880,7 @@ "value": "423440" }, { - "description": "Medical, Dental, and Hospital Equipment and Supplies Merchant Wholesalers ", + "description": "Medical, Dental, and Hospital Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21901,7 +21901,7 @@ "value": "42345" }, { - "description": "Medical, Dental, and Hospital Equipment and Supplies Merchant Wholesalers ", + "description": "Medical, Dental, and Hospital Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21922,7 +21922,7 @@ "value": "423450" }, { - "description": "Ophthalmic Goods Merchant Wholesalers ", + "description": "Ophthalmic Goods Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21943,7 +21943,7 @@ "value": "42346" }, { - "description": "Ophthalmic Goods Merchant Wholesalers ", + "description": "Ophthalmic Goods Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21964,7 +21964,7 @@ "value": "423460" }, { - "description": "Other Professional Equipment and Supplies Merchant Wholesalers ", + "description": "Other Professional Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -21985,7 +21985,7 @@ "value": "42349" }, { - "description": "Other Professional Equipment and Supplies Merchant Wholesalers ", + "description": "Other Professional Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "3e401895-3f6b-4be6-b8a0-99879dbfc7d3", @@ -22006,7 +22006,7 @@ "value": "423490" }, { - "description": "Metal and Mineral (except Petroleum) Merchant Wholesalers ", + "description": "Metal and Mineral (except Petroleum) Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -22048,7 +22048,7 @@ "value": "4235" }, { - "description": "Metal Service Centers and Other Metal Merchant Wholesalers ", + "description": "Metal Service Centers and Other Metal Merchant Wholesalers", "related": [ { "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", @@ -22069,7 +22069,7 @@ "value": "42351" }, { - "description": "Metal Service Centers and Other Metal Merchant Wholesalers ", + "description": "Metal Service Centers and Other Metal Merchant Wholesalers", "related": [ { "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", @@ -22090,7 +22090,7 @@ "value": "423510" }, { - "description": "Coal and Other Mineral and Ore Merchant Wholesalers ", + "description": "Coal and Other Mineral and Ore Merchant Wholesalers", "related": [ { "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", @@ -22111,7 +22111,7 @@ "value": "42352" }, { - "description": "Coal and Other Mineral and Ore Merchant Wholesalers ", + "description": "Coal and Other Mineral and Ore Merchant Wholesalers", "related": [ { "dest-uuid": "399872d4-cd54-491e-8ed0-4ea83971d52a", @@ -22132,7 +22132,7 @@ "value": "423520" }, { - "description": "Household Appliances and Electrical and Electronic Goods Merchant Wholesalers ", + "description": "Household Appliances and Electrical and Electronic Goods Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -22188,7 +22188,7 @@ "value": "4236" }, { - "description": "Electrical Apparatus and Equipment, Wiring Supplies, and Related Equipment Merchant Wholesalers ", + "description": "Electrical Apparatus and Equipment, Wiring Supplies, and Related Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", @@ -22209,7 +22209,7 @@ "value": "42361" }, { - "description": "Electrical Apparatus and Equipment, Wiring Supplies, and Related Equipment Merchant Wholesalers ", + "description": "Electrical Apparatus and Equipment, Wiring Supplies, and Related Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", @@ -22230,7 +22230,7 @@ "value": "423610" }, { - "description": "Household Appliances, Electric Housewares, and Consumer Electronics Merchant Wholesalers ", + "description": "Household Appliances, Electric Housewares, and Consumer Electronics Merchant Wholesalers", "related": [ { "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", @@ -22251,7 +22251,7 @@ "value": "42362" }, { - "description": "Household Appliances, Electric Housewares, and Consumer Electronics Merchant Wholesalers ", + "description": "Household Appliances, Electric Housewares, and Consumer Electronics Merchant Wholesalers", "related": [ { "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", @@ -22272,7 +22272,7 @@ "value": "423620" }, { - "description": "Other Electronic Parts and Equipment Merchant Wholesalers ", + "description": "Other Electronic Parts and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", @@ -22293,7 +22293,7 @@ "value": "42369" }, { - "description": "Other Electronic Parts and Equipment Merchant Wholesalers ", + "description": "Other Electronic Parts and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "0a16685e-8c8b-4df9-a2c7-95b4d1e84f66", @@ -22314,7 +22314,7 @@ "value": "423690" }, { - "description": "Hardware, and Plumbing and Heating Equipment and Supplies Merchant Wholesalers ", + "description": "Hardware, and Plumbing and Heating Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -22384,7 +22384,7 @@ "value": "4237" }, { - "description": "Hardware Merchant Wholesalers ", + "description": "Hardware Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22405,7 +22405,7 @@ "value": "42371" }, { - "description": "Hardware Merchant Wholesalers ", + "description": "Hardware Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22426,7 +22426,7 @@ "value": "423710" }, { - "description": "Plumbing and Heating Equipment and Supplies (Hydronics) Merchant Wholesalers ", + "description": "Plumbing and Heating Equipment and Supplies (Hydronics) Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22447,7 +22447,7 @@ "value": "42372" }, { - "description": "Plumbing and Heating Equipment and Supplies (Hydronics) Merchant Wholesalers ", + "description": "Plumbing and Heating Equipment and Supplies (Hydronics) Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22468,7 +22468,7 @@ "value": "423720" }, { - "description": "Warm Air Heating and Air-Conditioning Equipment and Supplies Merchant Wholesalers ", + "description": "Warm Air Heating and Air-Conditioning Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22489,7 +22489,7 @@ "value": "42373" }, { - "description": "Warm Air Heating and Air-Conditioning Equipment and Supplies Merchant Wholesalers ", + "description": "Warm Air Heating and Air-Conditioning Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22510,7 +22510,7 @@ "value": "423730" }, { - "description": "Refrigeration Equipment and Supplies Merchant Wholesalers ", + "description": "Refrigeration Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22531,7 +22531,7 @@ "value": "42374" }, { - "description": "Refrigeration Equipment and Supplies Merchant Wholesalers ", + "description": "Refrigeration Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "4796cd36-e54f-4c4b-9a75-32a3f7416826", @@ -22552,7 +22552,7 @@ "value": "423740" }, { - "description": "Machinery, Equipment, and Supplies Merchant Wholesalers ", + "description": "Machinery, Equipment, and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -22650,7 +22650,7 @@ "value": "4238" }, { - "description": "Construction and Mining (except Oil Well) Machinery and Equipment Merchant Wholesalers ", + "description": "Construction and Mining (except Oil Well) Machinery and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22671,7 +22671,7 @@ "value": "42381" }, { - "description": "Construction and Mining (except Oil Well) Machinery and Equipment Merchant Wholesalers ", + "description": "Construction and Mining (except Oil Well) Machinery and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22692,7 +22692,7 @@ "value": "423810" }, { - "description": "Farm and Garden Machinery and Equipment Merchant Wholesalers ", + "description": "Farm and Garden Machinery and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22713,7 +22713,7 @@ "value": "42382" }, { - "description": "Farm and Garden Machinery and Equipment Merchant Wholesalers ", + "description": "Farm and Garden Machinery and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22734,7 +22734,7 @@ "value": "423820" }, { - "description": "Industrial Machinery and Equipment Merchant Wholesalers ", + "description": "Industrial Machinery and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22755,7 +22755,7 @@ "value": "42383" }, { - "description": "Industrial Machinery and Equipment Merchant Wholesalers ", + "description": "Industrial Machinery and Equipment Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22776,7 +22776,7 @@ "value": "423830" }, { - "description": "Industrial Supplies Merchant Wholesalers ", + "description": "Industrial Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22818,7 +22818,7 @@ "value": "423840" }, { - "description": "Service Establishment Equipment and Supplies Merchant Wholesalers ", + "description": "Service Establishment Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22839,7 +22839,7 @@ "value": "42385" }, { - "description": "Service Establishment Equipment and Supplies Merchant Wholesalers ", + "description": "Service Establishment Equipment and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22860,7 +22860,7 @@ "value": "423850" }, { - "description": "Transportation Equipment and Supplies (except Motor Vehicle) Merchant Wholesalers ", + "description": "Transportation Equipment and Supplies (except Motor Vehicle) Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22881,7 +22881,7 @@ "value": "42386" }, { - "description": "Transportation Equipment and Supplies (except Motor Vehicle) Merchant Wholesalers ", + "description": "Transportation Equipment and Supplies (except Motor Vehicle) Merchant Wholesalers", "related": [ { "dest-uuid": "c1551289-fd16-4e07-9b3d-e17d3153734c", @@ -22902,7 +22902,7 @@ "value": "423860" }, { - "description": "Miscellaneous Durable Goods Merchant Wholesalers ", + "description": "Miscellaneous Durable Goods Merchant Wholesalers", "related": [ { "dest-uuid": "651ac35b-cb80-4b52-bcdf-61d71383c05f", @@ -23007,7 +23007,7 @@ "value": "42391" }, { - "description": "Sporting and Recreational Goods and Supplies Merchant Wholesalers ", + "description": "Sporting and Recreational Goods and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23028,7 +23028,7 @@ "value": "423910" }, { - "description": "Toy and Hobby Goods and Supplies Merchant Wholesalers ", + "description": "Toy and Hobby Goods and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23049,7 +23049,7 @@ "value": "42392" }, { - "description": "Toy and Hobby Goods and Supplies Merchant Wholesalers ", + "description": "Toy and Hobby Goods and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23070,7 +23070,7 @@ "value": "423920" }, { - "description": "Recyclable Material Merchant Wholesalers ", + "description": "Recyclable Material Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23091,7 +23091,7 @@ "value": "42393" }, { - "description": "Recyclable Material Merchant Wholesalers ", + "description": "Recyclable Material Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23112,7 +23112,7 @@ "value": "423930" }, { - "description": "Jewelry, Watch, Precious Stone, and Precious Metal Merchant Wholesalers ", + "description": "Jewelry, Watch, Precious Stone, and Precious Metal Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23133,7 +23133,7 @@ "value": "42394" }, { - "description": "Jewelry, Watch, Precious Stone, and Precious Metal Merchant Wholesalers ", + "description": "Jewelry, Watch, Precious Stone, and Precious Metal Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23154,7 +23154,7 @@ "value": "423940" }, { - "description": "Other Miscellaneous Durable Goods Merchant Wholesalers ", + "description": "Other Miscellaneous Durable Goods Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23175,7 +23175,7 @@ "value": "42399" }, { - "description": "Other Miscellaneous Durable Goods Merchant Wholesalers ", + "description": "Other Miscellaneous Durable Goods Merchant Wholesalers", "related": [ { "dest-uuid": "0b3ac6c2-a2d0-4ffd-b3d9-5faca94a6160", @@ -23196,7 +23196,7 @@ "value": "423990" }, { - "description": "Merchant Wholesalers, Nondurable Goods ", + "description": "Merchant Wholesalers, Nondurable Goods", "related": [ { "dest-uuid": "263d2cb5-c44f-4fb5-a5a1-b940375f7a5a", @@ -23273,7 +23273,7 @@ "value": "424" }, { - "description": "Paper and Paper Product Merchant Wholesalers ", + "description": "Paper and Paper Product Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -23329,7 +23329,7 @@ "value": "4241" }, { - "description": "Printing and Writing Paper Merchant Wholesalers ", + "description": "Printing and Writing Paper Merchant Wholesalers", "related": [ { "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", @@ -23350,7 +23350,7 @@ "value": "42411" }, { - "description": "Printing and Writing Paper Merchant Wholesalers ", + "description": "Printing and Writing Paper Merchant Wholesalers", "related": [ { "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", @@ -23371,7 +23371,7 @@ "value": "424110" }, { - "description": "Stationery and Office Supplies Merchant Wholesalers ", + "description": "Stationery and Office Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", @@ -23392,7 +23392,7 @@ "value": "42412" }, { - "description": "Stationery and Office Supplies Merchant Wholesalers ", + "description": "Stationery and Office Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", @@ -23413,7 +23413,7 @@ "value": "424120" }, { - "description": "Industrial and Personal Service Paper Merchant Wholesalers ", + "description": "Industrial and Personal Service Paper Merchant Wholesalers", "related": [ { "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", @@ -23434,7 +23434,7 @@ "value": "42413" }, { - "description": "Industrial and Personal Service Paper Merchant Wholesalers ", + "description": "Industrial and Personal Service Paper Merchant Wholesalers", "related": [ { "dest-uuid": "91521212-302d-4407-a1fe-b6d5b5fada3d", @@ -23455,7 +23455,7 @@ "value": "424130" }, { - "description": "Drugs and Druggists' Sundries Merchant Wholesalers ", + "description": "Drugs and Druggists' Sundries Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -23483,7 +23483,7 @@ "value": "4242" }, { - "description": "Drugs and Druggists' Sundries Merchant Wholesalers ", + "description": "Drugs and Druggists' Sundries Merchant Wholesalers", "related": [ { "dest-uuid": "56a85050-c5ec-4948-9470-685b22c04d49", @@ -23504,7 +23504,7 @@ "value": "42421" }, { - "description": "Drugs and Druggists' Sundries Merchant Wholesalers ", + "description": "Drugs and Druggists' Sundries Merchant Wholesalers", "related": [ { "dest-uuid": "56a85050-c5ec-4948-9470-685b22c04d49", @@ -23525,7 +23525,7 @@ "value": "424210" }, { - "description": "Apparel, Piece Goods, and Notions Merchant Wholesalers ", + "description": "Apparel, Piece Goods, and Notions Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -23581,7 +23581,7 @@ "value": "4243" }, { - "description": "Piece Goods, Notions, and Other Dry Goods Merchant Wholesalers ", + "description": "Piece Goods, Notions, and Other Dry Goods Merchant Wholesalers", "related": [ { "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", @@ -23602,7 +23602,7 @@ "value": "42431" }, { - "description": "Piece Goods, Notions, and Other Dry Goods Merchant Wholesalers ", + "description": "Piece Goods, Notions, and Other Dry Goods Merchant Wholesalers", "related": [ { "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", @@ -23623,7 +23623,7 @@ "value": "424310" }, { - "description": "Footwear Merchant Wholesalers ", + "description": "Footwear Merchant Wholesalers", "related": [ { "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", @@ -23644,7 +23644,7 @@ "value": "42434" }, { - "description": "Footwear Merchant Wholesalers ", + "description": "Footwear Merchant Wholesalers", "related": [ { "dest-uuid": "a412046b-8b65-4173-9eac-40dbc1c64794", @@ -23707,7 +23707,7 @@ "value": "424350" }, { - "description": "Grocery and Related Product Merchant Wholesalers ", + "description": "Grocery and Related Product Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -23847,7 +23847,7 @@ "value": "4244" }, { - "description": "General Line Grocery Merchant Wholesalers ", + "description": "General Line Grocery Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -23868,7 +23868,7 @@ "value": "42441" }, { - "description": "General Line Grocery Merchant Wholesalers ", + "description": "General Line Grocery Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -23889,7 +23889,7 @@ "value": "424410" }, { - "description": "Packaged Frozen Food Merchant Wholesalers ", + "description": "Packaged Frozen Food Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -23910,7 +23910,7 @@ "value": "42442" }, { - "description": "Packaged Frozen Food Merchant Wholesalers ", + "description": "Packaged Frozen Food Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -23931,7 +23931,7 @@ "value": "424420" }, { - "description": "Dairy Product (except Dried or Canned) Merchant Wholesalers ", + "description": "Dairy Product (except Dried or Canned) Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -23952,7 +23952,7 @@ "value": "42443" }, { - "description": "Dairy Product (except Dried or Canned) Merchant Wholesalers ", + "description": "Dairy Product (except Dried or Canned) Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -23973,7 +23973,7 @@ "value": "424430" }, { - "description": "Poultry and Poultry Product Merchant Wholesalers ", + "description": "Poultry and Poultry Product Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -23994,7 +23994,7 @@ "value": "42444" }, { - "description": "Poultry and Poultry Product Merchant Wholesalers ", + "description": "Poultry and Poultry Product Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24015,7 +24015,7 @@ "value": "424440" }, { - "description": "Confectionery Merchant Wholesalers ", + "description": "Confectionery Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24036,7 +24036,7 @@ "value": "42445" }, { - "description": "Confectionery Merchant Wholesalers ", + "description": "Confectionery Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24057,7 +24057,7 @@ "value": "424450" }, { - "description": "Fish and Seafood Merchant Wholesalers ", + "description": "Fish and Seafood Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24078,7 +24078,7 @@ "value": "42446" }, { - "description": "Fish and Seafood Merchant Wholesalers ", + "description": "Fish and Seafood Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24099,7 +24099,7 @@ "value": "424460" }, { - "description": "Meat and Meat Product Merchant Wholesalers ", + "description": "Meat and Meat Product Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24120,7 +24120,7 @@ "value": "42447" }, { - "description": "Meat and Meat Product Merchant Wholesalers ", + "description": "Meat and Meat Product Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24141,7 +24141,7 @@ "value": "424470" }, { - "description": "Fresh Fruit and Vegetable Merchant Wholesalers ", + "description": "Fresh Fruit and Vegetable Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24162,7 +24162,7 @@ "value": "42448" }, { - "description": "Fresh Fruit and Vegetable Merchant Wholesalers ", + "description": "Fresh Fruit and Vegetable Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24183,7 +24183,7 @@ "value": "424480" }, { - "description": "Other Grocery and Related Products Merchant Wholesalers ", + "description": "Other Grocery and Related Products Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24204,7 +24204,7 @@ "value": "42449" }, { - "description": "Other Grocery and Related Products Merchant Wholesalers ", + "description": "Other Grocery and Related Products Merchant Wholesalers", "related": [ { "dest-uuid": "9fbe45dd-763d-4399-92ba-dbfdb9e12863", @@ -24225,7 +24225,7 @@ "value": "424490" }, { - "description": "Farm Product Raw Material Merchant Wholesalers ", + "description": "Farm Product Raw Material Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -24281,7 +24281,7 @@ "value": "4245" }, { - "description": "Grain and Field Bean Merchant Wholesalers ", + "description": "Grain and Field Bean Merchant Wholesalers", "related": [ { "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", @@ -24302,7 +24302,7 @@ "value": "42451" }, { - "description": "Grain and Field Bean Merchant Wholesalers ", + "description": "Grain and Field Bean Merchant Wholesalers", "related": [ { "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", @@ -24323,7 +24323,7 @@ "value": "424510" }, { - "description": "Livestock Merchant Wholesalers ", + "description": "Livestock Merchant Wholesalers", "related": [ { "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", @@ -24344,7 +24344,7 @@ "value": "42452" }, { - "description": "Livestock Merchant Wholesalers ", + "description": "Livestock Merchant Wholesalers", "related": [ { "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", @@ -24365,7 +24365,7 @@ "value": "424520" }, { - "description": "Other Farm Product Raw Material Merchant Wholesalers ", + "description": "Other Farm Product Raw Material Merchant Wholesalers", "related": [ { "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", @@ -24386,7 +24386,7 @@ "value": "42459" }, { - "description": "Other Farm Product Raw Material Merchant Wholesalers ", + "description": "Other Farm Product Raw Material Merchant Wholesalers", "related": [ { "dest-uuid": "e550c841-c221-4aab-a6d9-5aef7d1f78ea", @@ -24407,7 +24407,7 @@ "value": "424590" }, { - "description": "Chemical and Allied Products Merchant Wholesalers ", + "description": "Chemical and Allied Products Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -24449,7 +24449,7 @@ "value": "4246" }, { - "description": "Plastics Materials and Basic Forms and Shapes Merchant Wholesalers ", + "description": "Plastics Materials and Basic Forms and Shapes Merchant Wholesalers", "related": [ { "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", @@ -24470,7 +24470,7 @@ "value": "42461" }, { - "description": "Plastics Materials and Basic Forms and Shapes Merchant Wholesalers ", + "description": "Plastics Materials and Basic Forms and Shapes Merchant Wholesalers", "related": [ { "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", @@ -24491,7 +24491,7 @@ "value": "424610" }, { - "description": "Other Chemical and Allied Products Merchant Wholesalers ", + "description": "Other Chemical and Allied Products Merchant Wholesalers", "related": [ { "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", @@ -24512,7 +24512,7 @@ "value": "42469" }, { - "description": "Other Chemical and Allied Products Merchant Wholesalers ", + "description": "Other Chemical and Allied Products Merchant Wholesalers", "related": [ { "dest-uuid": "62327c3b-e4ce-45b2-9729-03e6714d482b", @@ -24533,7 +24533,7 @@ "value": "424690" }, { - "description": "Petroleum and Petroleum Products Merchant Wholesalers ", + "description": "Petroleum and Petroleum Products Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -24575,7 +24575,7 @@ "value": "4247" }, { - "description": "Petroleum Bulk Stations and Terminals ", + "description": "Petroleum Bulk Stations and Terminals", "related": [ { "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", @@ -24596,7 +24596,7 @@ "value": "42471" }, { - "description": "Petroleum Bulk Stations and Terminals ", + "description": "Petroleum Bulk Stations and Terminals", "related": [ { "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", @@ -24617,7 +24617,7 @@ "value": "424710" }, { - "description": "Petroleum and Petroleum Products Merchant Wholesalers (except Bulk Stations and Terminals) ", + "description": "Petroleum and Petroleum Products Merchant Wholesalers (except Bulk Stations and Terminals)", "related": [ { "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", @@ -24638,7 +24638,7 @@ "value": "42472" }, { - "description": "Petroleum and Petroleum Products Merchant Wholesalers (except Bulk Stations and Terminals) ", + "description": "Petroleum and Petroleum Products Merchant Wholesalers (except Bulk Stations and Terminals)", "related": [ { "dest-uuid": "a43d7311-9d2f-4004-b805-e650a11bf4da", @@ -24659,7 +24659,7 @@ "value": "424720" }, { - "description": "Beer, Wine, and Distilled Alcoholic Beverage Merchant Wholesalers ", + "description": "Beer, Wine, and Distilled Alcoholic Beverage Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -24701,7 +24701,7 @@ "value": "4248" }, { - "description": "Beer and Ale Merchant Wholesalers ", + "description": "Beer and Ale Merchant Wholesalers", "related": [ { "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", @@ -24722,7 +24722,7 @@ "value": "42481" }, { - "description": "Beer and Ale Merchant Wholesalers ", + "description": "Beer and Ale Merchant Wholesalers", "related": [ { "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", @@ -24743,7 +24743,7 @@ "value": "424810" }, { - "description": "Wine and Distilled Alcoholic Beverage Merchant Wholesalers ", + "description": "Wine and Distilled Alcoholic Beverage Merchant Wholesalers", "related": [ { "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", @@ -24764,7 +24764,7 @@ "value": "42482" }, { - "description": "Wine and Distilled Alcoholic Beverage Merchant Wholesalers ", + "description": "Wine and Distilled Alcoholic Beverage Merchant Wholesalers", "related": [ { "dest-uuid": "78f2bfdc-aa34-47ec-b6c1-817c5f4858a1", @@ -24785,7 +24785,7 @@ "value": "424820" }, { - "description": "Miscellaneous Nondurable Goods Merchant Wholesalers ", + "description": "Miscellaneous Nondurable Goods Merchant Wholesalers", "related": [ { "dest-uuid": "5d4c06a2-48bf-4da0-8bc5-f31f81d1a972", @@ -24883,7 +24883,7 @@ "value": "4249" }, { - "description": "Farm Supplies Merchant Wholesalers ", + "description": "Farm Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -24904,7 +24904,7 @@ "value": "42491" }, { - "description": "Farm Supplies Merchant Wholesalers ", + "description": "Farm Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -24925,7 +24925,7 @@ "value": "424910" }, { - "description": "Book, Periodical, and Newspaper Merchant Wholesalers ", + "description": "Book, Periodical, and Newspaper Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -24946,7 +24946,7 @@ "value": "42492" }, { - "description": "Book, Periodical, and Newspaper Merchant Wholesalers ", + "description": "Book, Periodical, and Newspaper Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -24967,7 +24967,7 @@ "value": "424920" }, { - "description": "Flower, Nursery Stock, and Florists' Supplies Merchant Wholesalers ", + "description": "Flower, Nursery Stock, and Florists' Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -24988,7 +24988,7 @@ "value": "42493" }, { - "description": "Flower, Nursery Stock, and Florists' Supplies Merchant Wholesalers ", + "description": "Flower, Nursery Stock, and Florists' Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -25009,7 +25009,7 @@ "value": "424930" }, { - "description": "Tobacco Product and Electronic Cigarette Merchant Wholesalers ", + "description": "Tobacco Product and Electronic Cigarette Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -25030,7 +25030,7 @@ "value": "42494" }, { - "description": "Tobacco Product and Electronic Cigarette Merchant Wholesalers ", + "description": "Tobacco Product and Electronic Cigarette Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -25051,7 +25051,7 @@ "value": "424940" }, { - "description": "Paint, Varnish, and Supplies Merchant Wholesalers ", + "description": "Paint, Varnish, and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -25072,7 +25072,7 @@ "value": "42495" }, { - "description": "Paint, Varnish, and Supplies Merchant Wholesalers ", + "description": "Paint, Varnish, and Supplies Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -25093,7 +25093,7 @@ "value": "424950" }, { - "description": "Other Miscellaneous Nondurable Goods Merchant Wholesalers ", + "description": "Other Miscellaneous Nondurable Goods Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -25114,7 +25114,7 @@ "value": "42499" }, { - "description": "Other Miscellaneous Nondurable Goods Merchant Wholesalers ", + "description": "Other Miscellaneous Nondurable Goods Merchant Wholesalers", "related": [ { "dest-uuid": "00726563-500a-4f71-90f0-6233b559083d", @@ -25135,7 +25135,7 @@ "value": "424990" }, { - "description": "Wholesale Trade Agents and Brokers ", + "description": "Wholesale Trade Agents and Brokers", "related": [ { "dest-uuid": "263d2cb5-c44f-4fb5-a5a1-b940375f7a5a", @@ -25156,7 +25156,7 @@ "value": "425" }, { - "description": "Wholesale Trade Agents and Brokers ", + "description": "Wholesale Trade Agents and Brokers", "related": [ { "dest-uuid": "0efc2b37-40d3-4296-9fc0-3b3f40b224ad", @@ -25184,7 +25184,7 @@ "value": "4251" }, { - "description": "Wholesale Trade Agents and Brokers ", + "description": "Wholesale Trade Agents and Brokers", "related": [ { "dest-uuid": "89fb5c95-ca24-4353-863a-db5461032e40", @@ -25205,7 +25205,7 @@ "value": "42512" }, { - "description": "Wholesale Trade Agents and Brokers ", + "description": "Wholesale Trade Agents and Brokers", "related": [ { "dest-uuid": "89fb5c95-ca24-4353-863a-db5461032e40", @@ -25232,7 +25232,7 @@ "value": "44-45" }, { - "description": "Motor Vehicle and Parts Dealers ", + "description": "Motor Vehicle and Parts Dealers", "related": [ { "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", @@ -25260,7 +25260,7 @@ "value": "441" }, { - "description": "Automobile Dealers ", + "description": "Automobile Dealers", "related": [ { "dest-uuid": "fb7acddd-75c8-4688-8ba4-fdfcd11626f8", @@ -25302,7 +25302,7 @@ "value": "4411" }, { - "description": "New Car Dealers ", + "description": "New Car Dealers", "related": [ { "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", @@ -25323,7 +25323,7 @@ "value": "44111" }, { - "description": "New Car Dealers ", + "description": "New Car Dealers", "related": [ { "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", @@ -25344,7 +25344,7 @@ "value": "441110" }, { - "description": "Used Car Dealers ", + "description": "Used Car Dealers", "related": [ { "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", @@ -25365,7 +25365,7 @@ "value": "44112" }, { - "description": "Used Car Dealers ", + "description": "Used Car Dealers", "related": [ { "dest-uuid": "bc24003a-809f-4c09-a56f-07b513f0f43d", @@ -25386,7 +25386,7 @@ "value": "441120" }, { - "description": "Other Motor Vehicle Dealers ", + "description": "Other Motor Vehicle Dealers", "related": [ { "dest-uuid": "fb7acddd-75c8-4688-8ba4-fdfcd11626f8", @@ -25435,7 +25435,7 @@ "value": "4412" }, { - "description": "Recreational Vehicle Dealers ", + "description": "Recreational Vehicle Dealers", "related": [ { "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", @@ -25456,7 +25456,7 @@ "value": "44121" }, { - "description": "Recreational Vehicle Dealers ", + "description": "Recreational Vehicle Dealers", "related": [ { "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", @@ -25477,7 +25477,7 @@ "value": "441210" }, { - "description": "Motorcycle, Boat, and Other Motor Vehicle Dealers ", + "description": "Motorcycle, Boat, and Other Motor Vehicle Dealers", "related": [ { "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", @@ -25491,7 +25491,7 @@ "value": "44122" }, { - "description": "Boat Dealers ", + "description": "Boat Dealers", "related": [ { "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", @@ -25505,7 +25505,7 @@ "value": "441222" }, { - "description": "Motorcycle, ATV, and All Other Motor Vehicle Dealers ", + "description": "Motorcycle, ATV, and All Other Motor Vehicle Dealers", "related": [ { "dest-uuid": "2824aec0-0aba-4b33-b321-959348bd9a5d", @@ -25519,7 +25519,7 @@ "value": "441227" }, { - "description": "Automotive Parts, Accessories, and Tire Retailers ", + "description": "Automotive Parts, Accessories, and Tire Retailers", "related": [ { "dest-uuid": "fb7acddd-75c8-4688-8ba4-fdfcd11626f8", @@ -25561,7 +25561,7 @@ "value": "4413" }, { - "description": "Automotive Parts and Accessories Retailers ", + "description": "Automotive Parts and Accessories Retailers", "related": [ { "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", @@ -25582,7 +25582,7 @@ "value": "44133" }, { - "description": "Automotive Parts and Accessories Retailers ", + "description": "Automotive Parts and Accessories Retailers", "related": [ { "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", @@ -25603,7 +25603,7 @@ "value": "441330" }, { - "description": "Tire Dealers ", + "description": "Tire Dealers", "related": [ { "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", @@ -25624,7 +25624,7 @@ "value": "44134" }, { - "description": "Tire Dealers ", + "description": "Tire Dealers", "related": [ { "dest-uuid": "5859ea88-f021-48a9-895b-5a91f31551ca", @@ -25645,7 +25645,7 @@ "value": "441340" }, { - "description": "Building Material and Garden Equipment and Supplies Dealers ", + "description": "Building Material and Garden Equipment and Supplies Dealers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25666,7 +25666,7 @@ "value": "444" }, { - "description": "Building Material and Supplies Dealers ", + "description": "Building Material and Supplies Dealers", "related": [ { "dest-uuid": "89452db1-76f4-4824-a463-e7f6aa4d3563", @@ -25736,7 +25736,7 @@ "value": "4441" }, { - "description": "Home Centers ", + "description": "Home Centers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25757,7 +25757,7 @@ "value": "44411" }, { - "description": "Home Centers ", + "description": "Home Centers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25778,7 +25778,7 @@ "value": "444110" }, { - "description": "Paint and Wallpaper Retailers ", + "description": "Paint and Wallpaper Retailers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25799,7 +25799,7 @@ "value": "44412" }, { - "description": "Paint and Wallpaper Retailers ", + "description": "Paint and Wallpaper Retailers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25820,7 +25820,7 @@ "value": "444120" }, { - "description": "Hardware Retailers ", + "description": "Hardware Retailers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25841,7 +25841,7 @@ "value": "44414" }, { - "description": "Hardware Retailers ", + "description": "Hardware Retailers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25862,7 +25862,7 @@ "value": "444140" }, { - "description": "Other Building Material Dealers ", + "description": "Other Building Material Dealers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25883,7 +25883,7 @@ "value": "44418" }, { - "description": "Other Building Material Dealers ", + "description": "Other Building Material Dealers", "related": [ { "dest-uuid": "a89f6221-cd3a-4379-b428-6b2419722fde", @@ -25904,7 +25904,7 @@ "value": "444180" }, { - "description": "Lawn and Garden Equipment and Supplies Retailers ", + "description": "Lawn and Garden Equipment and Supplies Retailers", "related": [ { "dest-uuid": "89452db1-76f4-4824-a463-e7f6aa4d3563", @@ -25946,7 +25946,7 @@ "value": "4442" }, { - "description": "Outdoor Power Equipment Retailers ", + "description": "Outdoor Power Equipment Retailers", "related": [ { "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", @@ -25967,7 +25967,7 @@ "value": "44423" }, { - "description": "Outdoor Power Equipment Retailers ", + "description": "Outdoor Power Equipment Retailers", "related": [ { "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", @@ -25988,7 +25988,7 @@ "value": "444230" }, { - "description": "Nursery, Garden Center, and Farm Supply Retailers ", + "description": "Nursery, Garden Center, and Farm Supply Retailers", "related": [ { "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", @@ -26009,7 +26009,7 @@ "value": "44424" }, { - "description": "Nursery, Garden Center, and Farm Supply Retailers ", + "description": "Nursery, Garden Center, and Farm Supply Retailers", "related": [ { "dest-uuid": "fee42b94-518c-4e07-accf-61e3a4fd2a62", @@ -26030,7 +26030,7 @@ "value": "444240" }, { - "description": "Food and Beverage Retailers ", + "description": "Food and Beverage Retailers", "related": [ { "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", @@ -26058,7 +26058,7 @@ "value": "445" }, { - "description": "Grocery and Convenience Retailers ", + "description": "Grocery and Convenience Retailers", "related": [ { "dest-uuid": "01270670-e811-482c-b0e5-4b6c6ae17599", @@ -26107,7 +26107,7 @@ "value": "4451" }, { - "description": "Supermarkets and Other Grocery Retailers (except Convenience Retailers) ", + "description": "Supermarkets and Other Grocery Retailers (except Convenience Retailers)", "related": [ { "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", @@ -26128,7 +26128,7 @@ "value": "44511" }, { - "description": "Supermarkets and Other Grocery Retailers (except Convenience Retailers) ", + "description": "Supermarkets and Other Grocery Retailers (except Convenience Retailers)", "related": [ { "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", @@ -26149,7 +26149,7 @@ "value": "445110" }, { - "description": "Convenience Retailers and Vending Machine Operators ", + "description": "Convenience Retailers and Vending Machine Operators", "related": [ { "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", @@ -26163,7 +26163,7 @@ "value": "44513" }, { - "description": "Convenience Retailers ", + "description": "Convenience Retailers", "related": [ { "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", @@ -26177,7 +26177,7 @@ "value": "445131" }, { - "description": "Vending Machine Operators ", + "description": "Vending Machine Operators", "related": [ { "dest-uuid": "99c8b8ff-be6d-401e-b0e1-b751052e2e99", @@ -26191,7 +26191,7 @@ "value": "445132" }, { - "description": "Specialty Food Retailers ", + "description": "Specialty Food Retailers", "related": [ { "dest-uuid": "01270670-e811-482c-b0e5-4b6c6ae17599", @@ -26275,7 +26275,7 @@ "value": "4452" }, { - "description": "Fruit and Vegetable Retailers ", + "description": "Fruit and Vegetable Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26296,7 +26296,7 @@ "value": "44523" }, { - "description": "Fruit and Vegetable Retailers ", + "description": "Fruit and Vegetable Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26317,7 +26317,7 @@ "value": "445230" }, { - "description": "Meat Retailers ", + "description": "Meat Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26338,7 +26338,7 @@ "value": "44524" }, { - "description": "Meat Retailers ", + "description": "Meat Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26359,7 +26359,7 @@ "value": "445240" }, { - "description": "Fish and Seafood Retailers ", + "description": "Fish and Seafood Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26380,7 +26380,7 @@ "value": "44525" }, { - "description": "Fish and Seafood Retailers ", + "description": "Fish and Seafood Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26401,7 +26401,7 @@ "value": "445250" }, { - "description": "Other Specialty Food Retailers ", + "description": "Other Specialty Food Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26415,7 +26415,7 @@ "value": "44529" }, { - "description": "Baked Goods Retailers ", + "description": "Baked Goods Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26429,7 +26429,7 @@ "value": "445291" }, { - "description": "Confectionery and Nut Retailers ", + "description": "Confectionery and Nut Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26443,7 +26443,7 @@ "value": "445292" }, { - "description": "All Other Specialty Food Retailers ", + "description": "All Other Specialty Food Retailers", "related": [ { "dest-uuid": "25c3bf39-d0bb-4fd9-9ff4-40ff5e480de3", @@ -26457,7 +26457,7 @@ "value": "445298" }, { - "description": "Beer, Wine, and Liquor Retailers ", + "description": "Beer, Wine, and Liquor Retailers", "related": [ { "dest-uuid": "01270670-e811-482c-b0e5-4b6c6ae17599", @@ -26485,7 +26485,7 @@ "value": "4453" }, { - "description": "Beer, Wine, and Liquor Retailers ", + "description": "Beer, Wine, and Liquor Retailers", "related": [ { "dest-uuid": "ec36b6c8-1704-4f4b-b8ad-aa9a7c5244bb", @@ -26506,7 +26506,7 @@ "value": "44532" }, { - "description": "Beer, Wine, and Liquor Retailers ", + "description": "Beer, Wine, and Liquor Retailers", "related": [ { "dest-uuid": "ec36b6c8-1704-4f4b-b8ad-aa9a7c5244bb", @@ -26527,7 +26527,7 @@ "value": "445320" }, { - "description": "Furniture, Home Furnishings, Electronics, and Appliance Retailers ", + "description": "Furniture, Home Furnishings, Electronics, and Appliance Retailers", "related": [ { "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", @@ -26548,7 +26548,7 @@ "value": "449" }, { - "description": "Furniture and Home Furnishings Retailers ", + "description": "Furniture and Home Furnishings Retailers", "related": [ { "dest-uuid": "1d78d5cc-683b-4810-a4b8-1db1c093fb92", @@ -26604,7 +26604,7 @@ "value": "4491" }, { - "description": "Furniture Retailers ", + "description": "Furniture Retailers", "related": [ { "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", @@ -26625,7 +26625,7 @@ "value": "44911" }, { - "description": "Furniture Retailers ", + "description": "Furniture Retailers", "related": [ { "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", @@ -26646,7 +26646,7 @@ "value": "449110" }, { - "description": "Home Furnishings Retailers ", + "description": "Home Furnishings Retailers", "related": [ { "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", @@ -26660,7 +26660,7 @@ "value": "44912" }, { - "description": "Floor Covering Retailers ", + "description": "Floor Covering Retailers", "related": [ { "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", @@ -26674,7 +26674,7 @@ "value": "449121" }, { - "description": "Window Treatment Retailers ", + "description": "Window Treatment Retailers", "related": [ { "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", @@ -26688,7 +26688,7 @@ "value": "449122" }, { - "description": "All Other Home Furnishings Retailers ", + "description": "All Other Home Furnishings Retailers", "related": [ { "dest-uuid": "44494b74-cecb-4e45-ad71-ecf261581ceb", @@ -26702,7 +26702,7 @@ "value": "449129" }, { - "description": "Electronics and Appliance Retailers ", + "description": "Electronics and Appliance Retailers", "related": [ { "dest-uuid": "1d78d5cc-683b-4810-a4b8-1db1c093fb92", @@ -26730,7 +26730,7 @@ "value": "4492" }, { - "description": "Electronics and Appliance Retailers ", + "description": "Electronics and Appliance Retailers", "related": [ { "dest-uuid": "1ad0a5f1-a6b7-4e83-bee9-b1cdf4d411b1", @@ -26751,7 +26751,7 @@ "value": "44921" }, { - "description": "Electronics and Appliance Retailers ", + "description": "Electronics and Appliance Retailers", "related": [ { "dest-uuid": "1ad0a5f1-a6b7-4e83-bee9-b1cdf4d411b1", @@ -26772,7 +26772,7 @@ "value": "449210" }, { - "description": "General Merchandise Retailers ", + "description": "General Merchandise Retailers", "related": [ { "dest-uuid": "3efe54b2-4f50-400b-b15f-7ecdd017ea8f", @@ -26793,7 +26793,7 @@ "value": "455" }, { - "description": "Department Stores ", + "description": "Department Stores", "related": [ { "dest-uuid": "c2d6435c-7854-4ab5-8ffa-d48f78bde470", @@ -26821,7 +26821,7 @@ "value": "4551" }, { - "description": "Department Stores ", + "description": "Department Stores", "related": [ { "dest-uuid": "3efe54b2-4f50-400b-b15f-7ecdd017ea8f", @@ -26842,7 +26842,7 @@ "value": "45511" }, { - "description": "Department Stores ", + "description": "Department Stores", "related": [ { "dest-uuid": "3efe54b2-4f50-400b-b15f-7ecdd017ea8f", @@ -26863,7 +26863,7 @@ "value": "455110" }, { - "description": "Warehouse Clubs, Supercenters, and Other General Merchandise Retailers ", + "description": "Warehouse Clubs, Supercenters, and Other General Merchandise Retailers", "related": [ { "dest-uuid": "c2d6435c-7854-4ab5-8ffa-d48f78bde470", @@ -26898,7 +26898,7 @@ "value": "4552" }, { - "description": "Warehouse Clubs, Supercenters, and Other General Merchandise Retailers ", + "description": "Warehouse Clubs, Supercenters, and Other General Merchandise Retailers", "related": [ { "dest-uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", @@ -26912,7 +26912,7 @@ "value": "45521" }, { - "description": "Warehouse Clubs and Supercenters ", + "description": "Warehouse Clubs and Supercenters", "related": [ { "dest-uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", @@ -26926,7 +26926,7 @@ "value": "455211" }, { - "description": "All Other General Merchandise Retailers ", + "description": "All Other General Merchandise Retailers", "related": [ { "dest-uuid": "c58294dd-f3b8-4e03-a93f-c21ccdf16b20", @@ -26940,7 +26940,7 @@ "value": "455219" }, { - "description": "Health and Personal Care Retailers ", + "description": "Health and Personal Care Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -26954,7 +26954,7 @@ "value": "456" }, { - "description": "Health and Personal Care Retailers ", + "description": "Health and Personal Care Retailers", "related": [ { "dest-uuid": "bc8f36d8-e7cb-492b-b53a-89f9a7068731", @@ -27031,7 +27031,7 @@ "value": "4561" }, { - "description": "Pharmacies and Drug Retailers ", + "description": "Pharmacies and Drug Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27052,7 +27052,7 @@ "value": "45611" }, { - "description": "Pharmacies and Drug Retailers ", + "description": "Pharmacies and Drug Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27073,7 +27073,7 @@ "value": "456110" }, { - "description": "Cosmetics, Beauty Supplies, and Perfume Retailers ", + "description": "Cosmetics, Beauty Supplies, and Perfume Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27094,7 +27094,7 @@ "value": "45612" }, { - "description": "Cosmetics, Beauty Supplies, and Perfume Retailers ", + "description": "Cosmetics, Beauty Supplies, and Perfume Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27115,7 +27115,7 @@ "value": "456120" }, { - "description": "Optical Goods Retailers ", + "description": "Optical Goods Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27136,7 +27136,7 @@ "value": "45613" }, { - "description": "Optical Goods Retailers ", + "description": "Optical Goods Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27157,7 +27157,7 @@ "value": "456130" }, { - "description": "Other Health and Personal Care Retailers ", + "description": "Other Health and Personal Care Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27171,7 +27171,7 @@ "value": "45619" }, { - "description": "Food (Health) Supplement Retailers ", + "description": "Food (Health) Supplement Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27185,7 +27185,7 @@ "value": "456191" }, { - "description": "All Other Health and Personal Care Retailers ", + "description": "All Other Health and Personal Care Retailers", "related": [ { "dest-uuid": "01dcb9f9-e9d0-4427-8036-a0638db11fc5", @@ -27199,7 +27199,7 @@ "value": "456199" }, { - "description": "Gasoline Stations and Fuel Dealers ", + "description": "Gasoline Stations and Fuel Dealers", "related": [ { "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", @@ -27220,7 +27220,7 @@ "value": "457" }, { - "description": "Gasoline Stations ", + "description": "Gasoline Stations", "related": [ { "dest-uuid": "9ac1af03-2efa-40fb-96fa-b64b839b9fa7", @@ -27262,7 +27262,7 @@ "value": "4571" }, { - "description": "Gasoline Stations with Convenience Stores ", + "description": "Gasoline Stations with Convenience Stores", "related": [ { "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", @@ -27283,7 +27283,7 @@ "value": "45711" }, { - "description": "Gasoline Stations with Convenience Stores ", + "description": "Gasoline Stations with Convenience Stores", "related": [ { "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", @@ -27304,7 +27304,7 @@ "value": "457110" }, { - "description": "Other Gasoline Stations ", + "description": "Other Gasoline Stations", "related": [ { "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", @@ -27325,7 +27325,7 @@ "value": "45712" }, { - "description": "Other Gasoline Stations ", + "description": "Other Gasoline Stations", "related": [ { "dest-uuid": "b0795a6d-d4ef-49ff-aeaf-b9c41783e8f7", @@ -27395,7 +27395,7 @@ "value": "45721" }, { - "description": "Fuel Dealers ", + "description": "Fuel Dealers", "related": [ { "dest-uuid": "c0185539-397d-47f8-8d71-ed590b6dbf94", @@ -27416,7 +27416,7 @@ "value": "457210" }, { - "description": "Clothing, Clothing Accessories, Shoe, and Jewelry Retailers ", + "description": "Clothing, Clothing Accessories, Shoe, and Jewelry Retailers", "related": [ { "dest-uuid": "aba17827-fac1-48c4-9920-08e5c877ed17", @@ -27444,7 +27444,7 @@ "value": "458" }, { - "description": "Clothing and Clothing Accessories Retailers ", + "description": "Clothing and Clothing Accessories Retailers", "related": [ { "dest-uuid": "9eb95e6c-d2a0-42a7-bf0b-e124351536a8", @@ -27472,7 +27472,7 @@ "value": "4581" }, { - "description": "Clothing and Clothing Accessories Retailers ", + "description": "Clothing and Clothing Accessories Retailers", "related": [ { "dest-uuid": "aba17827-fac1-48c4-9920-08e5c877ed17", @@ -27493,7 +27493,7 @@ "value": "45811" }, { - "description": "Clothing and Clothing Accessories Retailers ", + "description": "Clothing and Clothing Accessories Retailers", "related": [ { "dest-uuid": "aba17827-fac1-48c4-9920-08e5c877ed17", @@ -27514,7 +27514,7 @@ "value": "458110" }, { - "description": "Shoe Retailers ", + "description": "Shoe Retailers", "related": [ { "dest-uuid": "9eb95e6c-d2a0-42a7-bf0b-e124351536a8", @@ -27542,7 +27542,7 @@ "value": "4582" }, { - "description": "Shoe Retailers ", + "description": "Shoe Retailers", "related": [ { "dest-uuid": "12327773-ef57-43c0-a13c-a56b02bc3df4", @@ -27563,7 +27563,7 @@ "value": "45821" }, { - "description": "Shoe Retailers ", + "description": "Shoe Retailers", "related": [ { "dest-uuid": "12327773-ef57-43c0-a13c-a56b02bc3df4", @@ -27584,7 +27584,7 @@ "value": "458210" }, { - "description": "Jewelry, Luggage, and Leather Goods Retailers ", + "description": "Jewelry, Luggage, and Leather Goods Retailers", "related": [ { "dest-uuid": "9eb95e6c-d2a0-42a7-bf0b-e124351536a8", @@ -27626,7 +27626,7 @@ "value": "4583" }, { - "description": "Jewelry Retailers ", + "description": "Jewelry Retailers", "related": [ { "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", @@ -27647,7 +27647,7 @@ "value": "45831" }, { - "description": "Jewelry Retailers ", + "description": "Jewelry Retailers", "related": [ { "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", @@ -27668,7 +27668,7 @@ "value": "458310" }, { - "description": "Luggage and Leather Goods Retailers ", + "description": "Luggage and Leather Goods Retailers", "related": [ { "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", @@ -27689,7 +27689,7 @@ "value": "45832" }, { - "description": "Luggage and Leather Goods Retailers ", + "description": "Luggage and Leather Goods Retailers", "related": [ { "dest-uuid": "0ae63545-9fae-4414-9c05-2f1ac87f7dba", @@ -27710,7 +27710,7 @@ "value": "458320" }, { - "description": "Sporting Goods, Hobby, Musical Instrument, Book, and Miscellaneous Retailers ", + "description": "Sporting Goods, Hobby, Musical Instrument, Book, and Miscellaneous Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27759,7 +27759,7 @@ "value": "459" }, { - "description": "Sporting Goods, Hobby, and Musical Instrument Retailers ", + "description": "Sporting Goods, Hobby, and Musical Instrument Retailers", "related": [ { "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", @@ -27829,7 +27829,7 @@ "value": "4591" }, { - "description": "Sporting Goods Retailers ", + "description": "Sporting Goods Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27850,7 +27850,7 @@ "value": "45911" }, { - "description": "Sporting Goods Retailers ", + "description": "Sporting Goods Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27871,7 +27871,7 @@ "value": "459110" }, { - "description": "Hobby, Toy, and Game Retailers ", + "description": "Hobby, Toy, and Game Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27892,7 +27892,7 @@ "value": "45912" }, { - "description": "Hobby, Toy, and Game Retailers ", + "description": "Hobby, Toy, and Game Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27913,7 +27913,7 @@ "value": "459120" }, { - "description": "Sewing, Needlework, and Piece Goods Retailers ", + "description": "Sewing, Needlework, and Piece Goods Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27934,7 +27934,7 @@ "value": "45913" }, { - "description": "Sewing, Needlework, and Piece Goods Retailers ", + "description": "Sewing, Needlework, and Piece Goods Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27955,7 +27955,7 @@ "value": "459130" }, { - "description": "Musical Instrument and Supplies Retailers ", + "description": "Musical Instrument and Supplies Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27976,7 +27976,7 @@ "value": "45914" }, { - "description": "Musical Instrument and Supplies Retailers ", + "description": "Musical Instrument and Supplies Retailers", "related": [ { "dest-uuid": "dc93c003-8862-4ac3-b8d7-d7665657dd5e", @@ -27997,7 +27997,7 @@ "value": "459140" }, { - "description": "Book Retailers and News Dealers ", + "description": "Book Retailers and News Dealers", "related": [ { "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", @@ -28025,7 +28025,7 @@ "value": "4592" }, { - "description": "Book Retailers and News Dealers ", + "description": "Book Retailers and News Dealers", "related": [ { "dest-uuid": "62054d35-82cf-4219-92f3-73ab70c6f72a", @@ -28046,7 +28046,7 @@ "value": "45921" }, { - "description": "Book Retailers and News Dealers ", + "description": "Book Retailers and News Dealers", "related": [ { "dest-uuid": "62054d35-82cf-4219-92f3-73ab70c6f72a", @@ -28067,7 +28067,7 @@ "value": "459210" }, { - "description": "Florists ", + "description": "Florists", "related": [ { "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", @@ -28095,7 +28095,7 @@ "value": "4593" }, { - "description": "Florists ", + "description": "Florists", "related": [ { "dest-uuid": "b725df0b-b77f-409c-89ca-a37ccb89de6d", @@ -28116,7 +28116,7 @@ "value": "45931" }, { - "description": "Florists ", + "description": "Florists", "related": [ { "dest-uuid": "b725df0b-b77f-409c-89ca-a37ccb89de6d", @@ -28137,7 +28137,7 @@ "value": "459310" }, { - "description": "Office Supplies, Stationery, and Gift Retailers ", + "description": "Office Supplies, Stationery, and Gift Retailers", "related": [ { "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", @@ -28179,7 +28179,7 @@ "value": "4594" }, { - "description": "Office Supplies and Stationery Retailers ", + "description": "Office Supplies and Stationery Retailers", "related": [ { "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", @@ -28200,7 +28200,7 @@ "value": "45941" }, { - "description": "Office Supplies and Stationery Retailers ", + "description": "Office Supplies and Stationery Retailers", "related": [ { "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", @@ -28221,7 +28221,7 @@ "value": "459410" }, { - "description": "Gift, Novelty, and Souvenir Retailers ", + "description": "Gift, Novelty, and Souvenir Retailers", "related": [ { "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", @@ -28242,7 +28242,7 @@ "value": "45942" }, { - "description": "Gift, Novelty, and Souvenir Retailers ", + "description": "Gift, Novelty, and Souvenir Retailers", "related": [ { "dest-uuid": "bcf40586-411a-4bef-9d28-77c796adac84", @@ -28263,7 +28263,7 @@ "value": "459420" }, { - "description": "Used Merchandise Retailers ", + "description": "Used Merchandise Retailers", "related": [ { "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", @@ -28291,7 +28291,7 @@ "value": "4595" }, { - "description": "Used Merchandise Retailers ", + "description": "Used Merchandise Retailers", "related": [ { "dest-uuid": "8bb7111f-582f-4992-9a5e-4bd20db92d6a", @@ -28312,7 +28312,7 @@ "value": "45951" }, { - "description": "Used Merchandise Retailers ", + "description": "Used Merchandise Retailers", "related": [ { "dest-uuid": "8bb7111f-582f-4992-9a5e-4bd20db92d6a", @@ -28333,7 +28333,7 @@ "value": "459510" }, { - "description": "Other Miscellaneous Retailers ", + "description": "Other Miscellaneous Retailers", "related": [ { "dest-uuid": "959cfe5d-cf01-4d5a-bd72-1e258611dbc8", @@ -28410,7 +28410,7 @@ "value": "4599" }, { - "description": "Pet and Pet Supplies Retailers ", + "description": "Pet and Pet Supplies Retailers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28431,7 +28431,7 @@ "value": "45991" }, { - "description": "Pet and Pet Supplies Retailers ", + "description": "Pet and Pet Supplies Retailers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28452,7 +28452,7 @@ "value": "459910" }, { - "description": "Art Dealers ", + "description": "Art Dealers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28473,7 +28473,7 @@ "value": "45992" }, { - "description": "Art Dealers ", + "description": "Art Dealers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28494,7 +28494,7 @@ "value": "459920" }, { - "description": "Manufactured (Mobile) Home Dealers ", + "description": "Manufactured (Mobile) Home Dealers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28515,7 +28515,7 @@ "value": "45993" }, { - "description": "Manufactured (Mobile) Home Dealers ", + "description": "Manufactured (Mobile) Home Dealers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28536,7 +28536,7 @@ "value": "459930" }, { - "description": "All Other Miscellaneous Retailers ", + "description": "All Other Miscellaneous Retailers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28550,7 +28550,7 @@ "value": "45999" }, { - "description": "Tobacco, Electronic Cigarette, and Other Smoking Supplies Retailers ", + "description": "Tobacco, Electronic Cigarette, and Other Smoking Supplies Retailers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28564,7 +28564,7 @@ "value": "459991" }, { - "description": "All Other Miscellaneous Retailers ", + "description": "All Other Miscellaneous Retailers", "related": [ { "dest-uuid": "2c8b5613-a848-47ec-8a96-0ce7edbc364d", @@ -28654,7 +28654,7 @@ "value": "48111" }, { - "description": "Scheduled Passenger Air Transportation ", + "description": "Scheduled Passenger Air Transportation", "related": [ { "dest-uuid": "53613cf1-7055-4d5c-b17d-c072ce427675", @@ -28668,7 +28668,7 @@ "value": "481111" }, { - "description": "Scheduled Freight Air Transportation ", + "description": "Scheduled Freight Air Transportation", "related": [ { "dest-uuid": "53613cf1-7055-4d5c-b17d-c072ce427675", @@ -28738,7 +28738,7 @@ "value": "48121" }, { - "description": "Nonscheduled Chartered Passenger Air Transportation ", + "description": "Nonscheduled Chartered Passenger Air Transportation", "related": [ { "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", @@ -28752,7 +28752,7 @@ "value": "481211" }, { - "description": "Nonscheduled Chartered Freight Air Transportation ", + "description": "Nonscheduled Chartered Freight Air Transportation", "related": [ { "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", @@ -28766,7 +28766,7 @@ "value": "481212" }, { - "description": "Other Nonscheduled Air Transportation ", + "description": "Other Nonscheduled Air Transportation", "related": [ { "dest-uuid": "0da3727c-bfa8-4662-86e5-2ad2d256ae10", @@ -28843,7 +28843,7 @@ "value": "48211" }, { - "description": "Line-Haul Railroads ", + "description": "Line-Haul Railroads", "related": [ { "dest-uuid": "35378118-c241-4974-a32c-d9695a1b5d5e", @@ -28857,7 +28857,7 @@ "value": "482111" }, { - "description": "Short Line Railroads ", + "description": "Short Line Railroads", "related": [ { "dest-uuid": "35378118-c241-4974-a32c-d9695a1b5d5e", @@ -28955,7 +28955,7 @@ "value": "48311" }, { - "description": "Deep Sea Freight Transportation ", + "description": "Deep Sea Freight Transportation", "related": [ { "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", @@ -28969,7 +28969,7 @@ "value": "483111" }, { - "description": "Deep Sea Passenger Transportation ", + "description": "Deep Sea Passenger Transportation", "related": [ { "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", @@ -28983,7 +28983,7 @@ "value": "483112" }, { - "description": "Coastal and Great Lakes Freight Transportation ", + "description": "Coastal and Great Lakes Freight Transportation", "related": [ { "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", @@ -28997,7 +28997,7 @@ "value": "483113" }, { - "description": "Coastal and Great Lakes Passenger Transportation ", + "description": "Coastal and Great Lakes Passenger Transportation", "related": [ { "dest-uuid": "1f297861-c2be-4f55-ab6c-f61fbd1808ba", @@ -29060,7 +29060,7 @@ "value": "48321" }, { - "description": "Inland Water Freight Transportation ", + "description": "Inland Water Freight Transportation", "related": [ { "dest-uuid": "9297dfbb-9653-48c7-b982-9260ff0f9fea", @@ -29074,7 +29074,7 @@ "value": "483211" }, { - "description": "Inland Water Passenger Transportation ", + "description": "Inland Water Passenger Transportation", "related": [ { "dest-uuid": "9297dfbb-9653-48c7-b982-9260ff0f9fea", @@ -29179,7 +29179,7 @@ "value": "48411" }, { - "description": "General Freight Trucking, Local ", + "description": "General Freight Trucking, Local", "related": [ { "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", @@ -29214,7 +29214,7 @@ "value": "48412" }, { - "description": "General Freight Trucking, Long-Distance, Truckload ", + "description": "General Freight Trucking, Long-Distance, Truckload", "related": [ { "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", @@ -29228,7 +29228,7 @@ "value": "484121" }, { - "description": "General Freight Trucking, Long-Distance, Less Than Truckload ", + "description": "General Freight Trucking, Long-Distance, Less Than Truckload", "related": [ { "dest-uuid": "bb079a84-5288-4d70-9c0a-1107c25f9413", @@ -29361,7 +29361,7 @@ "value": "48422" }, { - "description": "Specialized Freight (except Used Goods) Trucking, Local ", + "description": "Specialized Freight (except Used Goods) Trucking, Local", "related": [ { "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", @@ -29403,7 +29403,7 @@ "value": "48423" }, { - "description": "Specialized Freight (except Used Goods) Trucking, Long-Distance ", + "description": "Specialized Freight (except Used Goods) Trucking, Long-Distance", "related": [ { "dest-uuid": "ce89a1e8-1a05-41f2-9966-3bffe4eff846", @@ -29536,7 +29536,7 @@ "value": "48511" }, { - "description": "Mixed Mode Transit Systems ", + "description": "Mixed Mode Transit Systems", "related": [ { "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", @@ -29550,7 +29550,7 @@ "value": "485111" }, { - "description": "Commuter Rail Systems ", + "description": "Commuter Rail Systems", "related": [ { "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", @@ -29564,7 +29564,7 @@ "value": "485112" }, { - "description": "Bus and Other Motor Vehicle Transit Systems ", + "description": "Bus and Other Motor Vehicle Transit Systems", "related": [ { "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", @@ -29578,7 +29578,7 @@ "value": "485113" }, { - "description": "Other Urban Transit Systems ", + "description": "Other Urban Transit Systems", "related": [ { "dest-uuid": "d9b1bff8-eae0-4f80-8597-2c49200e71d3", @@ -29725,7 +29725,7 @@ "value": "48531" }, { - "description": "Taxi and Ridesharing Services ", + "description": "Taxi and Ridesharing Services", "related": [ { "dest-uuid": "8b4e7868-d084-4b73-a885-da3bb1886103", @@ -29977,7 +29977,7 @@ "value": "48599" }, { - "description": "Special Needs Transportation ", + "description": "Special Needs Transportation", "related": [ { "dest-uuid": "748d12c1-02d2-4941-89fc-5146e0045e93", @@ -29991,7 +29991,7 @@ "value": "485991" }, { - "description": "All Other Transit and Ground Passenger Transportation ", + "description": "All Other Transit and Ground Passenger Transportation", "related": [ { "dest-uuid": "748d12c1-02d2-4941-89fc-5146e0045e93", @@ -30663,7 +30663,7 @@ "value": "488111" }, { - "description": "Other Airport Operations ", + "description": "Other Airport Operations", "related": [ { "dest-uuid": "b60a3b3f-bcc1-4bba-af58-6e5cb222b159", @@ -30964,7 +30964,7 @@ "value": "48833" }, { - "description": "Navigational Services to Shipping ", + "description": "Navigational Services to Shipping", "related": [ { "dest-uuid": "73d7511f-b9aa-4fb1-919f-ebb0479c8815", @@ -31132,7 +31132,7 @@ "value": "48849" }, { - "description": "Other Support Activities for Road Transportation ", + "description": "Other Support Activities for Road Transportation", "related": [ { "dest-uuid": "75f80450-de18-436e-b585-62231d78c326", @@ -31202,7 +31202,7 @@ "value": "48851" }, { - "description": "Freight Transportation Arrangement ", + "description": "Freight Transportation Arrangement", "related": [ { "dest-uuid": "50f1254f-63b0-4073-a3bd-dc5da035b07b", @@ -31272,7 +31272,7 @@ "value": "48899" }, { - "description": "Packing and Crating ", + "description": "Packing and Crating", "related": [ { "dest-uuid": "cde7588d-c7df-48fa-840d-98a490e4e853", @@ -31286,7 +31286,7 @@ "value": "488991" }, { - "description": "All Other Support Activities for Transportation ", + "description": "All Other Support Activities for Transportation", "related": [ { "dest-uuid": "cde7588d-c7df-48fa-840d-98a490e4e853", @@ -31650,7 +31650,7 @@ "value": "49311" }, { - "description": "General Warehousing and Storage ", + "description": "General Warehousing and Storage", "related": [ { "dest-uuid": "022a756d-a016-4d9e-bd22-7784c825e77b", @@ -31979,7 +31979,7 @@ "value": "51211" }, { - "description": "Motion Picture and Video Production ", + "description": "Motion Picture and Video Production", "related": [ { "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", @@ -32056,7 +32056,7 @@ "value": "51213" }, { - "description": "Motion Picture Theaters (except Drive-Ins) ", + "description": "Motion Picture Theaters (except Drive-Ins)", "related": [ { "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", @@ -32070,7 +32070,7 @@ "value": "512131" }, { - "description": "Drive-In Motion Picture Theaters ", + "description": "Drive-In Motion Picture Theaters", "related": [ { "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", @@ -32098,7 +32098,7 @@ "value": "51219" }, { - "description": "Teleproduction and Other Postproduction Services ", + "description": "Teleproduction and Other Postproduction Services", "related": [ { "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", @@ -32112,7 +32112,7 @@ "value": "512191" }, { - "description": "Other Motion Picture and Video Industries ", + "description": "Other Motion Picture and Video Industries", "related": [ { "dest-uuid": "0eca936c-3660-43bc-a640-1facc2ea65d8", @@ -32504,7 +32504,7 @@ "value": "51311" }, { - "description": "Newspaper Publishers ", + "description": "Newspaper Publishers", "related": [ { "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", @@ -32546,7 +32546,7 @@ "value": "51312" }, { - "description": "Periodical Publishers ", + "description": "Periodical Publishers", "related": [ { "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", @@ -32588,7 +32588,7 @@ "value": "51313" }, { - "description": "Book Publishers ", + "description": "Book Publishers", "related": [ { "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", @@ -32630,7 +32630,7 @@ "value": "51314" }, { - "description": "Directory and Mailing List Publishers ", + "description": "Directory and Mailing List Publishers", "related": [ { "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", @@ -32665,7 +32665,7 @@ "value": "51319" }, { - "description": "Greeting Card Publishers ", + "description": "Greeting Card Publishers", "related": [ { "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", @@ -32679,7 +32679,7 @@ "value": "513191" }, { - "description": "All Other Publishers ", + "description": "All Other Publishers", "related": [ { "dest-uuid": "88859830-f5b1-4951-9a1a-8fd111835053", @@ -32854,7 +32854,7 @@ "value": "51611" }, { - "description": "Radio Broadcasting Stations ", + "description": "Radio Broadcasting Stations", "related": [ { "dest-uuid": "51805c94-98a4-454c-8dba-f5f40a6eed8f", @@ -33092,7 +33092,7 @@ "value": "51711" }, { - "description": "Wired Telecommunications Carriers ", + "description": "Wired Telecommunications Carriers", "related": [ { "dest-uuid": "f7d85b99-2ed7-46f2-b74c-b65f1f6d6cad", @@ -33281,7 +33281,7 @@ "value": "51781" }, { - "description": "All Other Telecommunications ", + "description": "All Other Telecommunications", "related": [ { "dest-uuid": "4f49488e-1aeb-4343-897d-50916a5cbdbe", @@ -33477,7 +33477,7 @@ "value": "51921" }, { - "description": "Libraries and Archives ", + "description": "Libraries and Archives", "related": [ { "dest-uuid": "f8953fa0-354b-40fb-8091-523a7ec8d045", @@ -33708,7 +33708,7 @@ "value": "522" }, { - "description": "Depository Credit Intermediation ", + "description": "Depository Credit Intermediation", "related": [ { "dest-uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", @@ -33764,7 +33764,7 @@ "value": "5221" }, { - "description": "Commercial Banking ", + "description": "Commercial Banking", "related": [ { "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", @@ -33785,7 +33785,7 @@ "value": "52211" }, { - "description": "Commercial Banking ", + "description": "Commercial Banking", "related": [ { "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", @@ -33806,7 +33806,7 @@ "value": "522110" }, { - "description": "Credit Unions ", + "description": "Credit Unions", "related": [ { "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", @@ -33827,7 +33827,7 @@ "value": "52213" }, { - "description": "Credit Unions ", + "description": "Credit Unions", "related": [ { "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", @@ -33848,7 +33848,7 @@ "value": "522130" }, { - "description": "Savings Institutions and Other Depository Credit Intermediation ", + "description": "Savings Institutions and Other Depository Credit Intermediation", "related": [ { "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", @@ -33869,7 +33869,7 @@ "value": "52218" }, { - "description": "Savings Institutions and Other Depository Credit Intermediation ", + "description": "Savings Institutions and Other Depository Credit Intermediation", "related": [ { "dest-uuid": "d391d575-c32a-470b-bb40-ffcedf4cb21f", @@ -33890,7 +33890,7 @@ "value": "522180" }, { - "description": "Nondepository Credit Intermediation ", + "description": "Nondepository Credit Intermediation", "related": [ { "dest-uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", @@ -33960,7 +33960,7 @@ "value": "5222" }, { - "description": "Credit Card Issuing ", + "description": "Credit Card Issuing", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -33981,7 +33981,7 @@ "value": "52221" }, { - "description": "Credit Card Issuing ", + "description": "Credit Card Issuing", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -34002,7 +34002,7 @@ "value": "522210" }, { - "description": "Sales Financing ", + "description": "Sales Financing", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -34023,7 +34023,7 @@ "value": "52222" }, { - "description": "Sales Financing ", + "description": "Sales Financing", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -34044,7 +34044,7 @@ "value": "522220" }, { - "description": "Other Nondepository Credit Intermediation ", + "description": "Other Nondepository Credit Intermediation", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -34058,7 +34058,7 @@ "value": "52229" }, { - "description": "Consumer Lending ", + "description": "Consumer Lending", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -34072,7 +34072,7 @@ "value": "522291" }, { - "description": "Real Estate Credit ", + "description": "Real Estate Credit", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -34086,7 +34086,7 @@ "value": "522292" }, { - "description": "International, Secondary Market, and All Other Nondepository Credit Intermediation ", + "description": "International, Secondary Market, and All Other Nondepository Credit Intermediation", "related": [ { "dest-uuid": "c22318dc-65a2-44cd-ac0a-a91df5eb69e9", @@ -34100,7 +34100,7 @@ "value": "522299" }, { - "description": "Activities Related to Credit Intermediation ", + "description": "Activities Related to Credit Intermediation", "related": [ { "dest-uuid": "4ed8a346-7074-4086-a61b-5c678d4ec442", @@ -34156,7 +34156,7 @@ "value": "5223" }, { - "description": "Mortgage and Nonmortgage Loan Brokers ", + "description": "Mortgage and Nonmortgage Loan Brokers", "related": [ { "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", @@ -34177,7 +34177,7 @@ "value": "52231" }, { - "description": "Mortgage and Nonmortgage Loan Brokers ", + "description": "Mortgage and Nonmortgage Loan Brokers", "related": [ { "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", @@ -34198,7 +34198,7 @@ "value": "522310" }, { - "description": "Financial Transactions Processing, Reserve, and Clearinghouse Activities ", + "description": "Financial Transactions Processing, Reserve, and Clearinghouse Activities", "related": [ { "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", @@ -34219,7 +34219,7 @@ "value": "52232" }, { - "description": "Financial Transactions Processing, Reserve, and Clearinghouse Activities ", + "description": "Financial Transactions Processing, Reserve, and Clearinghouse Activities", "related": [ { "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", @@ -34240,7 +34240,7 @@ "value": "522320" }, { - "description": "Other Activities Related to Credit Intermediation ", + "description": "Other Activities Related to Credit Intermediation", "related": [ { "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", @@ -34261,7 +34261,7 @@ "value": "52239" }, { - "description": "Other Activities Related to Credit Intermediation ", + "description": "Other Activities Related to Credit Intermediation", "related": [ { "dest-uuid": "e2e75a2d-d59b-4888-9ce6-b77f3474da1f", @@ -34359,7 +34359,7 @@ "value": "5231" }, { - "description": "Investment Banking and Securities Intermediation ", + "description": "Investment Banking and Securities Intermediation", "related": [ { "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", @@ -34380,7 +34380,7 @@ "value": "52315" }, { - "description": "Investment Banking and Securities Intermediation ", + "description": "Investment Banking and Securities Intermediation", "related": [ { "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", @@ -34401,7 +34401,7 @@ "value": "523150" }, { - "description": "Commodity Contracts Intermediation ", + "description": "Commodity Contracts Intermediation", "related": [ { "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", @@ -34422,7 +34422,7 @@ "value": "52316" }, { - "description": "Commodity Contracts Intermediation ", + "description": "Commodity Contracts Intermediation", "related": [ { "dest-uuid": "8609388c-0bf6-40e1-8542-46b366aac69d", @@ -34576,7 +34576,7 @@ "value": "5239" }, { - "description": "Miscellaneous Intermediation ", + "description": "Miscellaneous Intermediation", "related": [ { "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", @@ -34597,7 +34597,7 @@ "value": "52391" }, { - "description": "Miscellaneous Intermediation ", + "description": "Miscellaneous Intermediation", "related": [ { "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", @@ -34618,7 +34618,7 @@ "value": "523910" }, { - "description": "Portfolio Management and Investment Advice ", + "description": "Portfolio Management and Investment Advice", "related": [ { "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", @@ -34639,7 +34639,7 @@ "value": "52394" }, { - "description": "Portfolio Management and Investment Advice ", + "description": "Portfolio Management and Investment Advice", "related": [ { "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", @@ -34660,7 +34660,7 @@ "value": "523940" }, { - "description": "All Other Financial Investment Activities ", + "description": "All Other Financial Investment Activities", "related": [ { "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", @@ -34674,7 +34674,7 @@ "value": "52399" }, { - "description": "Trust, Fiduciary, and Custody Activities ", + "description": "Trust, Fiduciary, and Custody Activities", "related": [ { "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", @@ -34688,7 +34688,7 @@ "value": "523991" }, { - "description": "Miscellaneous Financial Investment Activities ", + "description": "Miscellaneous Financial Investment Activities", "related": [ { "dest-uuid": "277d816e-5973-463c-a30b-cda36c7816d7", @@ -34807,7 +34807,7 @@ "value": "5241" }, { - "description": "Direct Life, Health, and Medical Insurance Carriers ", + "description": "Direct Life, Health, and Medical Insurance Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34821,7 +34821,7 @@ "value": "52411" }, { - "description": "Direct Life Insurance Carriers ", + "description": "Direct Life Insurance Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34835,7 +34835,7 @@ "value": "524113" }, { - "description": "Direct Health and Medical Insurance Carriers ", + "description": "Direct Health and Medical Insurance Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34849,7 +34849,7 @@ "value": "524114" }, { - "description": "Direct Insurance (except Life, Health, and Medical) Carriers ", + "description": "Direct Insurance (except Life, Health, and Medical) Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34863,7 +34863,7 @@ "value": "52412" }, { - "description": "Direct Property and Casualty Insurance Carriers ", + "description": "Direct Property and Casualty Insurance Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34877,7 +34877,7 @@ "value": "524126" }, { - "description": "Direct Title Insurance Carriers ", + "description": "Direct Title Insurance Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34891,7 +34891,7 @@ "value": "524127" }, { - "description": "Other Direct Insurance (except Life, Health, and Medical) Carriers ", + "description": "Other Direct Insurance (except Life, Health, and Medical) Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34905,7 +34905,7 @@ "value": "524128" }, { - "description": "Reinsurance Carriers ", + "description": "Reinsurance Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -34926,7 +34926,7 @@ "value": "52413" }, { - "description": "Reinsurance Carriers ", + "description": "Reinsurance Carriers", "related": [ { "dest-uuid": "b719bfe5-8f7c-4f95-9a97-e77592f1d2ca", @@ -35003,7 +35003,7 @@ "value": "5242" }, { - "description": "Insurance Agencies and Brokerages ", + "description": "Insurance Agencies and Brokerages", "related": [ { "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", @@ -35024,7 +35024,7 @@ "value": "52421" }, { - "description": "Insurance Agencies and Brokerages ", + "description": "Insurance Agencies and Brokerages", "related": [ { "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", @@ -35045,7 +35045,7 @@ "value": "524210" }, { - "description": "Other Insurance Related Activities ", + "description": "Other Insurance Related Activities", "related": [ { "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", @@ -35059,7 +35059,7 @@ "value": "52429" }, { - "description": "Claims Adjusting ", + "description": "Claims Adjusting", "related": [ { "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", @@ -35073,7 +35073,7 @@ "value": "524291" }, { - "description": "Pharmacy Benefit Management and Other Third Party Administration of Insurance and Pension Funds ", + "description": "Pharmacy Benefit Management and Other Third Party Administration of Insurance and Pension Funds", "related": [ { "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", @@ -35087,7 +35087,7 @@ "value": "524292" }, { - "description": "All Other Insurance Related Activities ", + "description": "All Other Insurance Related Activities", "related": [ { "dest-uuid": "55dad4cf-ddfe-49f5-835f-e97c4db9d3b0", @@ -35101,7 +35101,7 @@ "value": "524298" }, { - "description": "Funds, Trusts, and Other Financial Vehicles ", + "description": "Funds, Trusts, and Other Financial Vehicles", "related": [ { "dest-uuid": "5b5670b9-0302-4d25-b1a0-a813e8a2e07d", @@ -35129,7 +35129,7 @@ "value": "525" }, { - "description": "Insurance and Employee Benefit Funds ", + "description": "Insurance and Employee Benefit Funds", "related": [ { "dest-uuid": "8769d32f-a13e-413c-b6fb-ad79ac758ec8", @@ -35185,7 +35185,7 @@ "value": "5251" }, { - "description": "Pension Funds ", + "description": "Pension Funds", "related": [ { "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", @@ -35206,7 +35206,7 @@ "value": "52511" }, { - "description": "Pension Funds ", + "description": "Pension Funds", "related": [ { "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", @@ -35227,7 +35227,7 @@ "value": "525110" }, { - "description": "Health and Welfare Funds ", + "description": "Health and Welfare Funds", "related": [ { "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", @@ -35248,7 +35248,7 @@ "value": "52512" }, { - "description": "Health and Welfare Funds ", + "description": "Health and Welfare Funds", "related": [ { "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", @@ -35269,7 +35269,7 @@ "value": "525120" }, { - "description": "Other Insurance Funds ", + "description": "Other Insurance Funds", "related": [ { "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", @@ -35290,7 +35290,7 @@ "value": "52519" }, { - "description": "Other Insurance Funds ", + "description": "Other Insurance Funds", "related": [ { "dest-uuid": "f9bf3df8-02c1-4866-aadc-63950abe46ce", @@ -35367,7 +35367,7 @@ "value": "5259" }, { - "description": "Open-End Investment Funds ", + "description": "Open-End Investment Funds", "related": [ { "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", @@ -35388,7 +35388,7 @@ "value": "52591" }, { - "description": "Open-End Investment Funds ", + "description": "Open-End Investment Funds", "related": [ { "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", @@ -35409,7 +35409,7 @@ "value": "525910" }, { - "description": "Trusts, Estates, and Agency Accounts ", + "description": "Trusts, Estates, and Agency Accounts", "related": [ { "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", @@ -35430,7 +35430,7 @@ "value": "52592" }, { - "description": "Trusts, Estates, and Agency Accounts ", + "description": "Trusts, Estates, and Agency Accounts", "related": [ { "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", @@ -35451,7 +35451,7 @@ "value": "525920" }, { - "description": "Other Financial Vehicles ", + "description": "Other Financial Vehicles", "related": [ { "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", @@ -35472,7 +35472,7 @@ "value": "52599" }, { - "description": "Other Financial Vehicles ", + "description": "Other Financial Vehicles", "related": [ { "dest-uuid": "7b9d73c6-671f-4fcf-9e20-8df53204cb30", @@ -35626,7 +35626,7 @@ "value": "5311" }, { - "description": "Lessors of Residential Buildings and Dwellings ", + "description": "Lessors of Residential Buildings and Dwellings", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35647,7 +35647,7 @@ "value": "53111" }, { - "description": "Lessors of Residential Buildings and Dwellings ", + "description": "Lessors of Residential Buildings and Dwellings", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35668,7 +35668,7 @@ "value": "531110" }, { - "description": "Lessors of Nonresidential Buildings (except Miniwarehouses) ", + "description": "Lessors of Nonresidential Buildings (except Miniwarehouses)", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35689,7 +35689,7 @@ "value": "53112" }, { - "description": "Lessors of Nonresidential Buildings (except Miniwarehouses) ", + "description": "Lessors of Nonresidential Buildings (except Miniwarehouses)", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35710,7 +35710,7 @@ "value": "531120" }, { - "description": "Lessors of Miniwarehouses and Self-Storage Units ", + "description": "Lessors of Miniwarehouses and Self-Storage Units", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35731,7 +35731,7 @@ "value": "53113" }, { - "description": "Lessors of Miniwarehouses and Self-Storage Units ", + "description": "Lessors of Miniwarehouses and Self-Storage Units", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35752,7 +35752,7 @@ "value": "531130" }, { - "description": "Lessors of Other Real Estate Property ", + "description": "Lessors of Other Real Estate Property", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35773,7 +35773,7 @@ "value": "53119" }, { - "description": "Lessors of Other Real Estate Property ", + "description": "Lessors of Other Real Estate Property", "related": [ { "dest-uuid": "f07be250-1b96-47a9-8da9-2e3df352676a", @@ -35927,7 +35927,7 @@ "value": "5313" }, { - "description": "Real Estate Property Managers ", + "description": "Real Estate Property Managers", "related": [ { "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", @@ -35941,7 +35941,7 @@ "value": "53131" }, { - "description": "Residential Property Managers ", + "description": "Residential Property Managers", "related": [ { "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", @@ -35955,7 +35955,7 @@ "value": "531311" }, { - "description": "Nonresidential Property Managers ", + "description": "Nonresidential Property Managers", "related": [ { "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", @@ -35969,7 +35969,7 @@ "value": "531312" }, { - "description": "Offices of Real Estate Appraisers ", + "description": "Offices of Real Estate Appraisers", "related": [ { "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", @@ -35990,7 +35990,7 @@ "value": "53132" }, { - "description": "Offices of Real Estate Appraisers ", + "description": "Offices of Real Estate Appraisers", "related": [ { "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", @@ -36011,7 +36011,7 @@ "value": "531320" }, { - "description": "Other Activities Related to Real Estate ", + "description": "Other Activities Related to Real Estate", "related": [ { "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", @@ -36032,7 +36032,7 @@ "value": "53139" }, { - "description": "Other Activities Related to Real Estate ", + "description": "Other Activities Related to Real Estate", "related": [ { "dest-uuid": "cd2cf391-3ec7-4cec-9948-ba0f3ca78896", @@ -36158,7 +36158,7 @@ "value": "53211" }, { - "description": "Passenger Car Rental ", + "description": "Passenger Car Rental", "related": [ { "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", @@ -36172,7 +36172,7 @@ "value": "532111" }, { - "description": "Passenger Car Leasing ", + "description": "Passenger Car Leasing", "related": [ { "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", @@ -36207,7 +36207,7 @@ "value": "53212" }, { - "description": "Truck, Utility Trailer, and RV (Recreational Vehicle) Rental and Leasing ", + "description": "Truck, Utility Trailer, and RV (Recreational Vehicle) Rental and Leasing", "related": [ { "dest-uuid": "c4a28339-f3eb-44f1-9900-0fcd0cc3a254", @@ -36340,7 +36340,7 @@ "value": "532210" }, { - "description": "Other Consumer Goods Rental ", + "description": "Other Consumer Goods Rental", "related": [ { "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", @@ -36382,7 +36382,7 @@ "value": "532282" }, { - "description": "Home Health Equipment Rental ", + "description": "Home Health Equipment Rental", "related": [ { "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", @@ -36396,7 +36396,7 @@ "value": "532283" }, { - "description": "Recreational Goods Rental ", + "description": "Recreational Goods Rental", "related": [ { "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", @@ -36410,7 +36410,7 @@ "value": "532284" }, { - "description": "All Other Consumer Goods Rental ", + "description": "All Other Consumer Goods Rental", "related": [ { "dest-uuid": "17c98194-51f8-4fab-b4f8-7f782f638c31", @@ -36571,7 +36571,7 @@ "value": "53241" }, { - "description": "Commercial Air, Rail, and Water Transportation Equipment Rental and Leasing ", + "description": "Commercial Air, Rail, and Water Transportation Equipment Rental and Leasing", "related": [ { "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", @@ -36585,7 +36585,7 @@ "value": "532411" }, { - "description": "Construction, Mining, and Forestry Machinery and Equipment Rental and Leasing ", + "description": "Construction, Mining, and Forestry Machinery and Equipment Rental and Leasing", "related": [ { "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", @@ -36662,7 +36662,7 @@ "value": "53249" }, { - "description": "Other Commercial and Industrial Machinery and Equipment Rental and Leasing ", + "description": "Other Commercial and Industrial Machinery and Equipment Rental and Leasing", "related": [ { "dest-uuid": "5a6fe724-e523-434d-acc4-2508ade47f93", @@ -37026,7 +37026,7 @@ "value": "54119" }, { - "description": "Title Abstract and Settlement Offices ", + "description": "Title Abstract and Settlement Offices", "related": [ { "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", @@ -37040,7 +37040,7 @@ "value": "541191" }, { - "description": "All Other Legal Services ", + "description": "All Other Legal Services", "related": [ { "dest-uuid": "e8818b18-04f1-4527-8a56-9df9407ad840", @@ -37117,7 +37117,7 @@ "value": "54121" }, { - "description": "Offices of Certified Public Accountants ", + "description": "Offices of Certified Public Accountants", "related": [ { "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", @@ -37131,7 +37131,7 @@ "value": "541211" }, { - "description": "Tax Preparation Services ", + "description": "Tax Preparation Services", "related": [ { "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", @@ -37145,7 +37145,7 @@ "value": "541213" }, { - "description": "Payroll Services ", + "description": "Payroll Services", "related": [ { "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", @@ -37159,7 +37159,7 @@ "value": "541214" }, { - "description": "Other Accounting Services ", + "description": "Other Accounting Services", "related": [ { "dest-uuid": "7ae4db2e-eca3-4cfc-8800-d5143fafd62a", @@ -37936,7 +37936,7 @@ "value": "54151" }, { - "description": "Custom Computer Programming Services ", + "description": "Custom Computer Programming Services", "related": [ { "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", @@ -37950,7 +37950,7 @@ "value": "541511" }, { - "description": "Computer Systems Design Services ", + "description": "Computer Systems Design Services", "related": [ { "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", @@ -37964,7 +37964,7 @@ "value": "541512" }, { - "description": "Computer Facilities Management Services ", + "description": "Computer Facilities Management Services", "related": [ { "dest-uuid": "d4d74b12-1713-4ad0-befb-1e752cd63fe9", @@ -38090,7 +38090,7 @@ "value": "54161" }, { - "description": "Administrative Management and General Management Consulting Services ", + "description": "Administrative Management and General Management Consulting Services", "related": [ { "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", @@ -38104,7 +38104,7 @@ "value": "541611" }, { - "description": "Human Resources Consulting Services ", + "description": "Human Resources Consulting Services", "related": [ { "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", @@ -38118,7 +38118,7 @@ "value": "541612" }, { - "description": "Marketing Consulting Services ", + "description": "Marketing Consulting Services", "related": [ { "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", @@ -38132,7 +38132,7 @@ "value": "541613" }, { - "description": "Process, Physical Distribution, and Logistics Consulting Services ", + "description": "Process, Physical Distribution, and Logistics Consulting Services", "related": [ { "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", @@ -38146,7 +38146,7 @@ "value": "541614" }, { - "description": "Other Management Consulting Services ", + "description": "Other Management Consulting Services", "related": [ { "dest-uuid": "d2f71818-e2a7-43a5-a7ec-1ec03e4a2853", @@ -38314,7 +38314,7 @@ "value": "54171" }, { - "description": "Research and Development in Nanotechnology ", + "description": "Research and Development in Nanotechnology", "related": [ { "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", @@ -38342,7 +38342,7 @@ "value": "541714" }, { - "description": "Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology) ", + "description": "Research and Development in the Physical, Engineering, and Life Sciences (except Nanotechnology and Biotechnology)", "related": [ { "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", @@ -38377,7 +38377,7 @@ "value": "54172" }, { - "description": "Research and Development in the Social Sciences and Humanities ", + "description": "Research and Development in the Social Sciences and Humanities", "related": [ { "dest-uuid": "bbcd0206-bf23-4a18-a4da-450fbea4b71d", @@ -38839,7 +38839,7 @@ "value": "54189" }, { - "description": "Other Services Related to Advertising ", + "description": "Other Services Related to Advertising", "related": [ { "dest-uuid": "ff10c1f7-4c86-4bda-8cd3-b103f45e4e40", @@ -39007,7 +39007,7 @@ "value": "54192" }, { - "description": "Photography Studios, Portrait ", + "description": "Photography Studios, Portrait", "related": [ { "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", @@ -39021,7 +39021,7 @@ "value": "541921" }, { - "description": "Commercial Photography ", + "description": "Commercial Photography", "related": [ { "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", @@ -39098,7 +39098,7 @@ "value": "54194" }, { - "description": "Veterinary Services ", + "description": "Veterinary Services", "related": [ { "dest-uuid": "9665f374-8f6a-4097-be70-01066dcd7ef6", @@ -39252,7 +39252,7 @@ "value": "55111" }, { - "description": "Offices of Bank Holding Companies ", + "description": "Offices of Bank Holding Companies", "related": [ { "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", @@ -39266,7 +39266,7 @@ "value": "551111" }, { - "description": "Offices of Other Holding Companies ", + "description": "Offices of Other Holding Companies", "related": [ { "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", @@ -39280,7 +39280,7 @@ "value": "551112" }, { - "description": "Corporate, Subsidiary, and Regional Managing Offices ", + "description": "Corporate, Subsidiary, and Regional Managing Offices", "related": [ { "dest-uuid": "5704d74c-6001-4c3c-b3b4-e6e57ed7590c", @@ -39602,7 +39602,7 @@ "value": "56131" }, { - "description": "Employment Placement Agencies ", + "description": "Employment Placement Agencies", "related": [ { "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", @@ -39616,7 +39616,7 @@ "value": "561311" }, { - "description": "Executive Search Services ", + "description": "Executive Search Services", "related": [ { "dest-uuid": "a324aa16-163d-4567-9cb1-d7e0f0e2030b", @@ -39896,7 +39896,7 @@ "value": "56142" }, { - "description": "Telephone Answering Services ", + "description": "Telephone Answering Services", "related": [ { "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", @@ -39910,7 +39910,7 @@ "value": "561421" }, { - "description": "Telemarketing Bureaus and Other Contact Centers ", + "description": "Telemarketing Bureaus and Other Contact Centers", "related": [ { "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", @@ -39938,7 +39938,7 @@ "value": "56143" }, { - "description": "Private Mail Centers ", + "description": "Private Mail Centers", "related": [ { "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", @@ -39952,7 +39952,7 @@ "value": "561431" }, { - "description": "Other Business Service Centers (including Copy Shops) ", + "description": "Other Business Service Centers (including Copy Shops)", "related": [ { "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", @@ -40064,7 +40064,7 @@ "value": "56149" }, { - "description": "Repossession Services ", + "description": "Repossession Services", "related": [ { "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", @@ -40078,7 +40078,7 @@ "value": "561491" }, { - "description": "Court Reporting and Stenotype Services ", + "description": "Court Reporting and Stenotype Services", "related": [ { "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", @@ -40092,7 +40092,7 @@ "value": "561492" }, { - "description": "All Other Business Support Services ", + "description": "All Other Business Support Services", "related": [ { "dest-uuid": "ced8dc87-73f8-41f7-93bc-c88219c3b050", @@ -40267,7 +40267,7 @@ "value": "56159" }, { - "description": "Convention and Visitors Bureaus ", + "description": "Convention and Visitors Bureaus", "related": [ { "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", @@ -40281,7 +40281,7 @@ "value": "561591" }, { - "description": "All Other Travel Arrangement and Reservation Services ", + "description": "All Other Travel Arrangement and Reservation Services", "related": [ { "dest-uuid": "1c27e091-fa07-4f89-a102-91e6e73d9bae", @@ -40372,7 +40372,7 @@ "value": "56161" }, { - "description": "Investigation and Personal Background Check Services ", + "description": "Investigation and Personal Background Check Services", "related": [ { "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", @@ -40386,7 +40386,7 @@ "value": "561611" }, { - "description": "Security Guards and Patrol Services ", + "description": "Security Guards and Patrol Services", "related": [ { "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", @@ -40400,7 +40400,7 @@ "value": "561612" }, { - "description": "Armored Car Services ", + "description": "Armored Car Services", "related": [ { "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", @@ -40428,7 +40428,7 @@ "value": "56162" }, { - "description": "Security Systems Services (except Locksmiths) ", + "description": "Security Systems Services (except Locksmiths)", "related": [ { "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", @@ -40442,7 +40442,7 @@ "value": "561621" }, { - "description": "Locksmiths ", + "description": "Locksmiths", "related": [ { "dest-uuid": "54ab36a4-95b7-4d93-b28c-66b911696242", @@ -40603,7 +40603,7 @@ "value": "56172" }, { - "description": "Janitorial Services ", + "description": "Janitorial Services", "related": [ { "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", @@ -40729,7 +40729,7 @@ "value": "56179" }, { - "description": "Other Services to Buildings and Dwellings ", + "description": "Other Services to Buildings and Dwellings", "related": [ { "dest-uuid": "bf0c5be4-175a-43f4-9b29-c8de0eb84836", @@ -40967,7 +40967,7 @@ "value": "562" }, { - "description": "Waste Collection ", + "description": "Waste Collection", "related": [ { "dest-uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", @@ -41009,7 +41009,7 @@ "value": "5621" }, { - "description": "Waste Collection ", + "description": "Waste Collection", "related": [ { "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", @@ -41023,7 +41023,7 @@ "value": "56211" }, { - "description": "Solid Waste Collection ", + "description": "Solid Waste Collection", "related": [ { "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", @@ -41037,7 +41037,7 @@ "value": "562111" }, { - "description": "Hazardous Waste Collection ", + "description": "Hazardous Waste Collection", "related": [ { "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", @@ -41051,7 +41051,7 @@ "value": "562112" }, { - "description": "Other Waste Collection ", + "description": "Other Waste Collection", "related": [ { "dest-uuid": "45cde1d4-f24b-4ba2-820f-7e5557d8b621", @@ -41065,7 +41065,7 @@ "value": "562119" }, { - "description": "Waste Treatment and Disposal ", + "description": "Waste Treatment and Disposal", "related": [ { "dest-uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", @@ -41114,7 +41114,7 @@ "value": "5622" }, { - "description": "Waste Treatment and Disposal ", + "description": "Waste Treatment and Disposal", "related": [ { "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", @@ -41128,7 +41128,7 @@ "value": "56221" }, { - "description": "Hazardous Waste Treatment and Disposal ", + "description": "Hazardous Waste Treatment and Disposal", "related": [ { "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", @@ -41142,7 +41142,7 @@ "value": "562211" }, { - "description": "Solid Waste Landfill ", + "description": "Solid Waste Landfill", "related": [ { "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", @@ -41156,7 +41156,7 @@ "value": "562212" }, { - "description": "Solid Waste Combustors and Incinerators ", + "description": "Solid Waste Combustors and Incinerators", "related": [ { "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", @@ -41170,7 +41170,7 @@ "value": "562213" }, { - "description": "Other Nonhazardous Waste Treatment and Disposal ", + "description": "Other Nonhazardous Waste Treatment and Disposal", "related": [ { "dest-uuid": "c0fd72e1-333c-4287-ae12-cc25cfa92ed8", @@ -41184,7 +41184,7 @@ "value": "562219" }, { - "description": "Remediation and Other Waste Management Services ", + "description": "Remediation and Other Waste Management Services", "related": [ { "dest-uuid": "b3164c14-7c49-4781-a1e4-19a5c3eee5b3", @@ -41247,7 +41247,7 @@ "value": "5629" }, { - "description": "Remediation Services ", + "description": "Remediation Services", "related": [ { "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", @@ -41268,7 +41268,7 @@ "value": "56291" }, { - "description": "Remediation Services ", + "description": "Remediation Services", "related": [ { "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", @@ -41289,7 +41289,7 @@ "value": "562910" }, { - "description": "Materials Recovery Facilities ", + "description": "Materials Recovery Facilities", "related": [ { "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", @@ -41310,7 +41310,7 @@ "value": "56292" }, { - "description": "Materials Recovery Facilities ", + "description": "Materials Recovery Facilities", "related": [ { "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", @@ -41331,7 +41331,7 @@ "value": "562920" }, { - "description": "All Other Waste Management Services ", + "description": "All Other Waste Management Services", "related": [ { "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", @@ -41345,7 +41345,7 @@ "value": "56299" }, { - "description": "Septic Tank and Related Services ", + "description": "Septic Tank and Related Services", "related": [ { "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", @@ -41359,7 +41359,7 @@ "value": "562991" }, { - "description": "All Other Miscellaneous Waste Management Services ", + "description": "All Other Miscellaneous Waste Management Services", "related": [ { "dest-uuid": "756d72df-b280-45b8-b405-1e6d2e210466", @@ -41478,7 +41478,7 @@ "value": "6111" }, { - "description": "Elementary and Secondary Schools ", + "description": "Elementary and Secondary Schools", "related": [ { "dest-uuid": "7db6382e-37c8-4ae9-a4b5-86b789435256", @@ -41499,7 +41499,7 @@ "value": "61111" }, { - "description": "Elementary and Secondary Schools ", + "description": "Elementary and Secondary Schools", "related": [ { "dest-uuid": "7db6382e-37c8-4ae9-a4b5-86b789435256", @@ -41569,7 +41569,7 @@ "value": "61121" }, { - "description": "Junior Colleges ", + "description": "Junior Colleges", "related": [ { "dest-uuid": "de0146fd-5a34-4e57-9b48-47293088011d", @@ -41639,7 +41639,7 @@ "value": "61131" }, { - "description": "Colleges, Universities, and Professional Schools ", + "description": "Colleges, Universities, and Professional Schools", "related": [ { "dest-uuid": "0b7fb81c-867a-46ad-a1df-38803247a5c6", @@ -41737,7 +41737,7 @@ "value": "61141" }, { - "description": "Business and Secretarial Schools ", + "description": "Business and Secretarial Schools", "related": [ { "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", @@ -41779,7 +41779,7 @@ "value": "61142" }, { - "description": "Computer Training ", + "description": "Computer Training", "related": [ { "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", @@ -41821,7 +41821,7 @@ "value": "61143" }, { - "description": "Professional and Management Development Training ", + "description": "Professional and Management Development Training", "related": [ { "dest-uuid": "2b3ac1cd-0434-4db6-b974-969c63703f2d", @@ -41842,7 +41842,7 @@ "value": "611430" }, { - "description": "Technical and Trade Schools ", + "description": "Technical and Trade Schools", "related": [ { "dest-uuid": "ba521d1d-213f-40bf-a0bf-87e82f2c23b9", @@ -41905,7 +41905,7 @@ "value": "61151" }, { - "description": "Cosmetology and Barber Schools ", + "description": "Cosmetology and Barber Schools", "related": [ { "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", @@ -41919,7 +41919,7 @@ "value": "611511" }, { - "description": "Flight Training ", + "description": "Flight Training", "related": [ { "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", @@ -41933,7 +41933,7 @@ "value": "611512" }, { - "description": "Apprenticeship Training ", + "description": "Apprenticeship Training", "related": [ { "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", @@ -41947,7 +41947,7 @@ "value": "611513" }, { - "description": "Other Technical and Trade Schools ", + "description": "Other Technical and Trade Schools", "related": [ { "dest-uuid": "c22fe489-ef46-41b7-ad33-da55b3159609", @@ -42066,7 +42066,7 @@ "value": "61161" }, { - "description": "Fine Arts Schools ", + "description": "Fine Arts Schools", "related": [ { "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", @@ -42108,7 +42108,7 @@ "value": "61162" }, { - "description": "Sports and Recreation Instruction ", + "description": "Sports and Recreation Instruction", "related": [ { "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", @@ -42150,7 +42150,7 @@ "value": "61163" }, { - "description": "Language Schools ", + "description": "Language Schools", "related": [ { "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", @@ -42185,7 +42185,7 @@ "value": "61169" }, { - "description": "Exam Preparation and Tutoring ", + "description": "Exam Preparation and Tutoring", "related": [ { "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", @@ -42199,7 +42199,7 @@ "value": "611691" }, { - "description": "Automobile Driving Schools ", + "description": "Automobile Driving Schools", "related": [ { "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", @@ -42213,7 +42213,7 @@ "value": "611692" }, { - "description": "All Other Miscellaneous Schools and Instruction ", + "description": "All Other Miscellaneous Schools and Instruction", "related": [ { "dest-uuid": "dfa1e5b3-a59e-4a3a-b16f-4cee1d83b250", @@ -42444,7 +42444,7 @@ "value": "62111" }, { - "description": "Offices of Physicians (except Mental Health Specialists) ", + "description": "Offices of Physicians (except Mental Health Specialists)", "related": [ { "dest-uuid": "31b13711-f097-454a-a7a2-dc1999a1f0d3", @@ -42458,7 +42458,7 @@ "value": "621111" }, { - "description": "Offices of Physicians, Mental Health Specialists ", + "description": "Offices of Physicians, Mental Health Specialists", "related": [ { "dest-uuid": "31b13711-f097-454a-a7a2-dc1999a1f0d3", @@ -42521,7 +42521,7 @@ "value": "62121" }, { - "description": "Offices of Dentists ", + "description": "Offices of Dentists", "related": [ { "dest-uuid": "2857d8c2-eba8-49b3-a5e6-a1b040ac3e00", @@ -42654,7 +42654,7 @@ "value": "62131" }, { - "description": "Offices of Chiropractors ", + "description": "Offices of Chiropractors", "related": [ { "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", @@ -42738,7 +42738,7 @@ "value": "62133" }, { - "description": "Offices of Mental Health Practitioners (except Physicians) ", + "description": "Offices of Mental Health Practitioners (except Physicians)", "related": [ { "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", @@ -42780,7 +42780,7 @@ "value": "62134" }, { - "description": "Offices of Physical, Occupational and Speech Therapists, and Audiologists ", + "description": "Offices of Physical, Occupational and Speech Therapists, and Audiologists", "related": [ { "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", @@ -42815,7 +42815,7 @@ "value": "62139" }, { - "description": "Offices of Podiatrists ", + "description": "Offices of Podiatrists", "related": [ { "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", @@ -42829,7 +42829,7 @@ "value": "621391" }, { - "description": "Offices of All Other Miscellaneous Health Practitioners ", + "description": "Offices of All Other Miscellaneous Health Practitioners", "related": [ { "dest-uuid": "0b508b08-4341-413a-85cf-f09ab763ab96", @@ -42941,7 +42941,7 @@ "value": "62141" }, { - "description": "Family Planning Centers ", + "description": "Family Planning Centers", "related": [ { "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", @@ -42983,7 +42983,7 @@ "value": "62142" }, { - "description": "Outpatient Mental Health and Substance Abuse Centers ", + "description": "Outpatient Mental Health and Substance Abuse Centers", "related": [ { "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", @@ -43018,7 +43018,7 @@ "value": "62149" }, { - "description": "HMO Medical Centers ", + "description": "HMO Medical Centers", "related": [ { "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", @@ -43032,7 +43032,7 @@ "value": "621491" }, { - "description": "Kidney Dialysis Centers ", + "description": "Kidney Dialysis Centers", "related": [ { "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", @@ -43046,7 +43046,7 @@ "value": "621492" }, { - "description": "Freestanding Ambulatory Surgical and Emergency Centers ", + "description": "Freestanding Ambulatory Surgical and Emergency Centers", "related": [ { "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", @@ -43060,7 +43060,7 @@ "value": "621493" }, { - "description": "All Other Outpatient Care Centers ", + "description": "All Other Outpatient Care Centers", "related": [ { "dest-uuid": "3ece2fdf-7870-4643-8a73-25b76d3ab64f", @@ -43123,7 +43123,7 @@ "value": "62151" }, { - "description": "Medical Laboratories ", + "description": "Medical Laboratories", "related": [ { "dest-uuid": "b41fa1ec-8d2e-46ed-b286-a2b9536fa5fa", @@ -43137,7 +43137,7 @@ "value": "621511" }, { - "description": "Diagnostic Imaging Centers ", + "description": "Diagnostic Imaging Centers", "related": [ { "dest-uuid": "b41fa1ec-8d2e-46ed-b286-a2b9536fa5fa", @@ -43291,7 +43291,7 @@ "value": "62191" }, { - "description": "Ambulance Services ", + "description": "Ambulance Services", "related": [ { "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", @@ -43326,7 +43326,7 @@ "value": "62199" }, { - "description": "Blood and Organ Banks ", + "description": "Blood and Organ Banks", "related": [ { "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", @@ -43340,7 +43340,7 @@ "value": "621991" }, { - "description": "All Other Miscellaneous Ambulatory Health Care Services ", + "description": "All Other Miscellaneous Ambulatory Health Care Services", "related": [ { "dest-uuid": "55377413-8821-4ce9-8fee-dfca8cb988bf", @@ -43438,7 +43438,7 @@ "value": "62211" }, { - "description": "General Medical and Surgical Hospitals ", + "description": "General Medical and Surgical Hospitals", "related": [ { "dest-uuid": "d8eb4461-48d5-4f91-b7b5-eac02152c0e8", @@ -43508,7 +43508,7 @@ "value": "62221" }, { - "description": "Psychiatric and Substance Abuse Hospitals ", + "description": "Psychiatric and Substance Abuse Hospitals", "related": [ { "dest-uuid": "e6b7ee44-6d3c-42c5-82d8-f4813c330d76", @@ -43578,7 +43578,7 @@ "value": "62231" }, { - "description": "Specialty (except Psychiatric and Substance Abuse) Hospitals ", + "description": "Specialty (except Psychiatric and Substance Abuse) Hospitals", "related": [ { "dest-uuid": "f90cd6c1-d73b-47be-b3df-f9c72c6ba8e8", @@ -43690,7 +43690,7 @@ "value": "62311" }, { - "description": "Nursing Care Facilities (Skilled Nursing Facilities) ", + "description": "Nursing Care Facilities (Skilled Nursing Facilities)", "related": [ { "dest-uuid": "d411da93-c7cd-4875-9328-0685379cc907", @@ -43774,7 +43774,7 @@ "value": "62321" }, { - "description": "Residential Intellectual and Developmental Disability Facilities ", + "description": "Residential Intellectual and Developmental Disability Facilities", "related": [ { "dest-uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", @@ -43816,7 +43816,7 @@ "value": "62322" }, { - "description": "Residential Mental Health and Substance Abuse Facilities ", + "description": "Residential Mental Health and Substance Abuse Facilities", "related": [ { "dest-uuid": "5fa27f70-a12b-433e-9dea-6899e6e08c27", @@ -43886,7 +43886,7 @@ "value": "62331" }, { - "description": "Continuing Care Retirement Communities ", + "description": "Continuing Care Retirement Communities", "related": [ { "dest-uuid": "0b9bd47c-dbfe-4dcf-93b0-b0ff2af296a2", @@ -43900,7 +43900,7 @@ "value": "623311" }, { - "description": "Assisted Living Facilities for the Elderly ", + "description": "Assisted Living Facilities for the Elderly", "related": [ { "dest-uuid": "0b9bd47c-dbfe-4dcf-93b0-b0ff2af296a2", @@ -43963,7 +43963,7 @@ "value": "62399" }, { - "description": "Other Residential Care Facilities ", + "description": "Other Residential Care Facilities", "related": [ { "dest-uuid": "69ee9ed8-0c6b-4caf-8e7b-da308dc5a00c", @@ -44103,7 +44103,7 @@ "value": "62411" }, { - "description": "Child and Youth Services ", + "description": "Child and Youth Services", "related": [ { "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", @@ -44145,7 +44145,7 @@ "value": "62412" }, { - "description": "Services for the Elderly and Persons with Disabilities ", + "description": "Services for the Elderly and Persons with Disabilities", "related": [ { "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", @@ -44187,7 +44187,7 @@ "value": "62419" }, { - "description": "Other Individual and Family Services ", + "description": "Other Individual and Family Services", "related": [ { "dest-uuid": "97d44e62-13b8-4e0a-8aba-cd8238ba713e", @@ -44292,7 +44292,7 @@ "value": "62421" }, { - "description": "Community Food Services ", + "description": "Community Food Services", "related": [ { "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", @@ -44327,7 +44327,7 @@ "value": "62422" }, { - "description": "Temporary Shelters ", + "description": "Temporary Shelters", "related": [ { "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", @@ -44341,7 +44341,7 @@ "value": "624221" }, { - "description": "Other Community Housing Services ", + "description": "Other Community Housing Services", "related": [ { "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", @@ -44376,7 +44376,7 @@ "value": "62423" }, { - "description": "Emergency and Other Relief Services ", + "description": "Emergency and Other Relief Services", "related": [ { "dest-uuid": "0a20abfa-f2f0-44ec-bb84-755e43be2962", @@ -44446,7 +44446,7 @@ "value": "62431" }, { - "description": "Vocational Rehabilitation Services ", + "description": "Vocational Rehabilitation Services", "related": [ { "dest-uuid": "9f5a2cb5-4b9b-4b8c-af55-36ba59e0c66e", @@ -44516,7 +44516,7 @@ "value": "62441" }, { - "description": "Child Care Services ", + "description": "Child Care Services", "related": [ { "dest-uuid": "75c088ec-3565-4d65-92b6-92133c4fa75d", @@ -44705,7 +44705,7 @@ "value": "71111" }, { - "description": "Theater Companies and Dinner Theaters ", + "description": "Theater Companies and Dinner Theaters", "related": [ { "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", @@ -44747,7 +44747,7 @@ "value": "71112" }, { - "description": "Dance Companies ", + "description": "Dance Companies", "related": [ { "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", @@ -44789,7 +44789,7 @@ "value": "71113" }, { - "description": "Musical Groups and Artists ", + "description": "Musical Groups and Artists", "related": [ { "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", @@ -44831,7 +44831,7 @@ "value": "71119" }, { - "description": "Other Performing Arts Companies ", + "description": "Other Performing Arts Companies", "related": [ { "dest-uuid": "1380c900-79af-4958-8dfe-908bb8f2a83b", @@ -44908,7 +44908,7 @@ "value": "71121" }, { - "description": "Sports Teams and Clubs ", + "description": "Sports Teams and Clubs", "related": [ { "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", @@ -44922,7 +44922,7 @@ "value": "711211" }, { - "description": "Racetracks ", + "description": "Racetracks", "related": [ { "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", @@ -44936,7 +44936,7 @@ "value": "711212" }, { - "description": "Other Spectator Sports ", + "description": "Other Spectator Sports", "related": [ { "dest-uuid": "af74bef3-ba28-452c-b880-144929fc6b8f", @@ -45013,7 +45013,7 @@ "value": "71131" }, { - "description": "Promoters of Performing Arts, Sports, and Similar Events with Facilities ", + "description": "Promoters of Performing Arts, Sports, and Similar Events with Facilities", "related": [ { "dest-uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", @@ -45055,7 +45055,7 @@ "value": "71132" }, { - "description": "Promoters of Performing Arts, Sports, and Similar Events without Facilities ", + "description": "Promoters of Performing Arts, Sports, and Similar Events without Facilities", "related": [ { "dest-uuid": "3a5f74e8-3b17-419b-b191-2275ae84bfa7", @@ -45195,7 +45195,7 @@ "value": "71151" }, { - "description": "Independent Artists, Writers, and Performers ", + "description": "Independent Artists, Writers, and Performers", "related": [ { "dest-uuid": "a80731be-afd3-4687-977c-7adbe9eee2ab", @@ -45328,7 +45328,7 @@ "value": "71211" }, { - "description": "Museums ", + "description": "Museums", "related": [ { "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", @@ -45412,7 +45412,7 @@ "value": "71213" }, { - "description": "Zoos and Botanical Gardens ", + "description": "Zoos and Botanical Gardens", "related": [ { "dest-uuid": "c6798f95-92fe-41df-9126-e57dd23b3284", @@ -45573,7 +45573,7 @@ "value": "71311" }, { - "description": "Amusement and Theme Parks ", + "description": "Amusement and Theme Parks", "related": [ { "dest-uuid": "2ba66334-fed4-4c91-97d2-f88a309e1128", @@ -45741,7 +45741,7 @@ "value": "71329" }, { - "description": "Other Gambling Industries ", + "description": "Other Gambling Industries", "related": [ { "dest-uuid": "8ad528f4-2994-459c-8979-a3306dd12843", @@ -46007,7 +46007,7 @@ "value": "71394" }, { - "description": "Fitness and Recreational Sports Centers ", + "description": "Fitness and Recreational Sports Centers", "related": [ { "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", @@ -46091,7 +46091,7 @@ "value": "71399" }, { - "description": "All Other Amusement and Recreation Industries ", + "description": "All Other Amusement and Recreation Industries", "related": [ { "dest-uuid": "4ed03907-e49a-4c9c-887f-db1f44ca5223", @@ -46252,7 +46252,7 @@ "value": "72111" }, { - "description": "Hotels (except Casino Hotels) and Motels ", + "description": "Hotels (except Casino Hotels) and Motels", "related": [ { "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", @@ -46329,7 +46329,7 @@ "value": "72119" }, { - "description": "Bed-and-Breakfast Inns ", + "description": "Bed-and-Breakfast Inns", "related": [ { "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", @@ -46343,7 +46343,7 @@ "value": "721191" }, { - "description": "All Other Traveler Accommodation ", + "description": "All Other Traveler Accommodation", "related": [ { "dest-uuid": "c8343a66-f043-468f-acc5-496b4d713b6d", @@ -46406,7 +46406,7 @@ "value": "72121" }, { - "description": "RV (Recreational Vehicle) Parks and Campgrounds ", + "description": "RV (Recreational Vehicle) Parks and Campgrounds", "related": [ { "dest-uuid": "1320cfd7-11ec-4e4c-a66f-550f03107988", @@ -46420,7 +46420,7 @@ "value": "721211" }, { - "description": "Recreational and Vacation Camps (except Campgrounds) ", + "description": "Recreational and Vacation Camps (except Campgrounds)", "related": [ { "dest-uuid": "1320cfd7-11ec-4e4c-a66f-550f03107988", @@ -46483,7 +46483,7 @@ "value": "72131" }, { - "description": "Rooming and Boarding Houses, Dormitories, and Workers' Camps ", + "description": "Rooming and Boarding Houses, Dormitories, and Workers' Camps", "related": [ { "dest-uuid": "de6f1021-4cfc-4175-b765-a6f3a818e6ef", @@ -46770,7 +46770,7 @@ "value": "72241" }, { - "description": "Drinking Places (Alcoholic Beverages) ", + "description": "Drinking Places (Alcoholic Beverages)", "related": [ { "dest-uuid": "e18e3623-0537-476a-81fc-0967679a96e4", @@ -46854,7 +46854,7 @@ "value": "72251" }, { - "description": "Full-Service Restaurants ", + "description": "Full-Service Restaurants", "related": [ { "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", @@ -46868,7 +46868,7 @@ "value": "722511" }, { - "description": "Limited-Service Restaurants ", + "description": "Limited-Service Restaurants", "related": [ { "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", @@ -46882,7 +46882,7 @@ "value": "722513" }, { - "description": "Cafeterias, Grill Buffets, and Buffets ", + "description": "Cafeterias, Grill Buffets, and Buffets", "related": [ { "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", @@ -46896,7 +46896,7 @@ "value": "722514" }, { - "description": "Snack and Nonalcoholic Beverage Bars ", + "description": "Snack and Nonalcoholic Beverage Bars", "related": [ { "dest-uuid": "0e9103be-560b-4cba-a5b0-b2ae7b40aee6", @@ -47085,7 +47085,7 @@ "value": "81111" }, { - "description": "General Automotive Repair ", + "description": "General Automotive Repair", "related": [ { "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", @@ -47099,7 +47099,7 @@ "value": "811111" }, { - "description": "Specialized Automotive Repair ", + "description": "Specialized Automotive Repair", "related": [ { "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", @@ -47127,7 +47127,7 @@ "value": "81112" }, { - "description": "Automotive Body, Paint, and Interior Repair and Maintenance ", + "description": "Automotive Body, Paint, and Interior Repair and Maintenance", "related": [ { "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", @@ -47141,7 +47141,7 @@ "value": "811121" }, { - "description": "Automotive Glass Replacement Shops ", + "description": "Automotive Glass Replacement Shops", "related": [ { "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", @@ -47169,7 +47169,7 @@ "value": "81119" }, { - "description": "Automotive Oil Change and Lubrication Shops ", + "description": "Automotive Oil Change and Lubrication Shops", "related": [ { "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", @@ -47183,7 +47183,7 @@ "value": "811191" }, { - "description": "Car Washes ", + "description": "Car Washes", "related": [ { "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", @@ -47197,7 +47197,7 @@ "value": "811192" }, { - "description": "All Other Automotive Repair and Maintenance ", + "description": "All Other Automotive Repair and Maintenance", "related": [ { "dest-uuid": "b0adc11f-a2c0-48d8-9510-8790282c8fbf", @@ -47260,7 +47260,7 @@ "value": "81121" }, { - "description": "Electronic and Precision Equipment Repair and Maintenance ", + "description": "Electronic and Precision Equipment Repair and Maintenance", "related": [ { "dest-uuid": "9e375a04-53f2-4c26-b47a-2f14a38d0fc9", @@ -47330,7 +47330,7 @@ "value": "81131" }, { - "description": "Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance ", + "description": "Commercial and Industrial Machinery and Equipment (except Automotive and Electronic) Repair and Maintenance", "related": [ { "dest-uuid": "25f5ede7-bf1d-4f02-acd6-424c994258c5", @@ -47442,7 +47442,7 @@ "value": "81141" }, { - "description": "Home and Garden Equipment Repair and Maintenance ", + "description": "Home and Garden Equipment Repair and Maintenance", "related": [ { "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", @@ -47456,7 +47456,7 @@ "value": "811411" }, { - "description": "Appliance Repair and Maintenance ", + "description": "Appliance Repair and Maintenance", "related": [ { "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", @@ -47575,7 +47575,7 @@ "value": "81149" }, { - "description": "Other Personal and Household Goods Repair and Maintenance ", + "description": "Other Personal and Household Goods Repair and Maintenance", "related": [ { "dest-uuid": "1d009354-1a25-4fd2-9f3f-5ac12369b054", @@ -47638,7 +47638,7 @@ "value": "812" }, { - "description": "Personal Care Services ", + "description": "Personal Care Services", "related": [ { "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", @@ -47701,7 +47701,7 @@ "value": "8121" }, { - "description": "Hair, Nail, and Skin Care Services ", + "description": "Hair, Nail, and Skin Care Services", "related": [ { "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", @@ -47715,7 +47715,7 @@ "value": "81211" }, { - "description": "Barber Shops ", + "description": "Barber Shops", "related": [ { "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", @@ -47729,7 +47729,7 @@ "value": "812111" }, { - "description": "Beauty Salons ", + "description": "Beauty Salons", "related": [ { "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", @@ -47743,7 +47743,7 @@ "value": "812112" }, { - "description": "Nail Salons ", + "description": "Nail Salons", "related": [ { "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", @@ -47757,7 +47757,7 @@ "value": "812113" }, { - "description": "Other Personal Care Services ", + "description": "Other Personal Care Services", "related": [ { "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", @@ -47771,7 +47771,7 @@ "value": "81219" }, { - "description": "Diet and Weight Reducing Centers ", + "description": "Diet and Weight Reducing Centers", "related": [ { "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", @@ -47785,7 +47785,7 @@ "value": "812191" }, { - "description": "Other Personal Care Services ", + "description": "Other Personal Care Services", "related": [ { "dest-uuid": "c2114692-331a-4a5d-b834-685d30d2cde9", @@ -47799,7 +47799,7 @@ "value": "812199" }, { - "description": "Death Care Services ", + "description": "Death Care Services", "related": [ { "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", @@ -47841,7 +47841,7 @@ "value": "8122" }, { - "description": "Funeral Homes and Funeral Services ", + "description": "Funeral Homes and Funeral Services", "related": [ { "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", @@ -47862,7 +47862,7 @@ "value": "81221" }, { - "description": "Funeral Homes and Funeral Services ", + "description": "Funeral Homes and Funeral Services", "related": [ { "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", @@ -47883,7 +47883,7 @@ "value": "812210" }, { - "description": "Cemeteries and Crematories ", + "description": "Cemeteries and Crematories", "related": [ { "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", @@ -47904,7 +47904,7 @@ "value": "81222" }, { - "description": "Cemeteries and Crematories ", + "description": "Cemeteries and Crematories", "related": [ { "dest-uuid": "cc100781-808c-42cd-b9a1-fb7be4178169", @@ -47925,7 +47925,7 @@ "value": "812220" }, { - "description": "Drycleaning and Laundry Services ", + "description": "Drycleaning and Laundry Services", "related": [ { "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", @@ -47988,7 +47988,7 @@ "value": "8123" }, { - "description": "Coin-Operated Laundries and Drycleaners ", + "description": "Coin-Operated Laundries and Drycleaners", "related": [ { "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", @@ -48009,7 +48009,7 @@ "value": "81231" }, { - "description": "Coin-Operated Laundries and Drycleaners ", + "description": "Coin-Operated Laundries and Drycleaners", "related": [ { "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", @@ -48030,7 +48030,7 @@ "value": "812310" }, { - "description": "Drycleaning and Laundry Services (except Coin-Operated) ", + "description": "Drycleaning and Laundry Services (except Coin-Operated)", "related": [ { "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", @@ -48051,7 +48051,7 @@ "value": "81232" }, { - "description": "Drycleaning and Laundry Services (except Coin-Operated) ", + "description": "Drycleaning and Laundry Services (except Coin-Operated)", "related": [ { "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", @@ -48072,7 +48072,7 @@ "value": "812320" }, { - "description": "Linen and Uniform Supply ", + "description": "Linen and Uniform Supply", "related": [ { "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", @@ -48086,7 +48086,7 @@ "value": "81233" }, { - "description": "Linen Supply ", + "description": "Linen Supply", "related": [ { "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", @@ -48100,7 +48100,7 @@ "value": "812331" }, { - "description": "Industrial Launderers ", + "description": "Industrial Launderers", "related": [ { "dest-uuid": "60f54859-4917-4d62-9b86-8d1fc74ce6b2", @@ -48114,7 +48114,7 @@ "value": "812332" }, { - "description": "Other Personal Services ", + "description": "Other Personal Services", "related": [ { "dest-uuid": "21dcc4c6-05bd-4e82-92bb-1e1b41da1659", @@ -48191,7 +48191,7 @@ "value": "8129" }, { - "description": "Pet Care (except Veterinary) Services ", + "description": "Pet Care (except Veterinary) Services", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48212,7 +48212,7 @@ "value": "81291" }, { - "description": "Pet Care (except Veterinary) Services ", + "description": "Pet Care (except Veterinary) Services", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48233,7 +48233,7 @@ "value": "812910" }, { - "description": "Photofinishing ", + "description": "Photofinishing", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48247,7 +48247,7 @@ "value": "81292" }, { - "description": "Photofinishing Laboratories (except One-Hour) ", + "description": "Photofinishing Laboratories (except One-Hour)", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48261,7 +48261,7 @@ "value": "812921" }, { - "description": "One-Hour Photofinishing ", + "description": "One-Hour Photofinishing", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48275,7 +48275,7 @@ "value": "812922" }, { - "description": "Parking Lots and Garages ", + "description": "Parking Lots and Garages", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48296,7 +48296,7 @@ "value": "81293" }, { - "description": "Parking Lots and Garages ", + "description": "Parking Lots and Garages", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48317,7 +48317,7 @@ "value": "812930" }, { - "description": "All Other Personal Services ", + "description": "All Other Personal Services", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48338,7 +48338,7 @@ "value": "81299" }, { - "description": "All Other Personal Services ", + "description": "All Other Personal Services", "related": [ { "dest-uuid": "8eac20b8-95dd-4a25-b65f-eace12c69e6f", @@ -48408,7 +48408,7 @@ "value": "813" }, { - "description": "Religious Organizations ", + "description": "Religious Organizations", "related": [ { "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", @@ -48436,7 +48436,7 @@ "value": "8131" }, { - "description": "Religious Organizations ", + "description": "Religious Organizations", "related": [ { "dest-uuid": "be333773-d086-4e27-b5ed-af3220bca134", @@ -48457,7 +48457,7 @@ "value": "81311" }, { - "description": "Religious Organizations ", + "description": "Religious Organizations", "related": [ { "dest-uuid": "be333773-d086-4e27-b5ed-af3220bca134", @@ -48478,7 +48478,7 @@ "value": "813110" }, { - "description": "Grantmaking and Giving Services ", + "description": "Grantmaking and Giving Services", "related": [ { "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", @@ -48520,7 +48520,7 @@ "value": "8132" }, { - "description": "Grantmaking and Giving Services ", + "description": "Grantmaking and Giving Services", "related": [ { "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", @@ -48534,7 +48534,7 @@ "value": "81321" }, { - "description": "Grantmaking Foundations ", + "description": "Grantmaking Foundations", "related": [ { "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", @@ -48548,7 +48548,7 @@ "value": "813211" }, { - "description": "Voluntary Health Organizations ", + "description": "Voluntary Health Organizations", "related": [ { "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", @@ -48562,7 +48562,7 @@ "value": "813212" }, { - "description": "Other Grantmaking and Giving Services ", + "description": "Other Grantmaking and Giving Services", "related": [ { "dest-uuid": "8118033e-c824-4edb-b17f-8e19f29c0ce7", @@ -48576,7 +48576,7 @@ "value": "813219" }, { - "description": "Social Advocacy Organizations ", + "description": "Social Advocacy Organizations", "related": [ { "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", @@ -48618,7 +48618,7 @@ "value": "8133" }, { - "description": "Social Advocacy Organizations ", + "description": "Social Advocacy Organizations", "related": [ { "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", @@ -48632,7 +48632,7 @@ "value": "81331" }, { - "description": "Human Rights Organizations ", + "description": "Human Rights Organizations", "related": [ { "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", @@ -48646,7 +48646,7 @@ "value": "813311" }, { - "description": "Environment, Conservation and Wildlife Organizations ", + "description": "Environment, Conservation and Wildlife Organizations", "related": [ { "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", @@ -48660,7 +48660,7 @@ "value": "813312" }, { - "description": "Other Social Advocacy Organizations ", + "description": "Other Social Advocacy Organizations", "related": [ { "dest-uuid": "679d5980-5809-4226-8980-89a57ce70cdf", @@ -48674,7 +48674,7 @@ "value": "813319" }, { - "description": "Civic and Social Organizations ", + "description": "Civic and Social Organizations", "related": [ { "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", @@ -48702,7 +48702,7 @@ "value": "8134" }, { - "description": "Civic and Social Organizations ", + "description": "Civic and Social Organizations", "related": [ { "dest-uuid": "8d95a395-059d-4ef2-9344-c54662166207", @@ -48723,7 +48723,7 @@ "value": "81341" }, { - "description": "Civic and Social Organizations ", + "description": "Civic and Social Organizations", "related": [ { "dest-uuid": "8d95a395-059d-4ef2-9344-c54662166207", @@ -48744,7 +48744,7 @@ "value": "813410" }, { - "description": "Business, Professional, Labor, Political, and Similar Organizations ", + "description": "Business, Professional, Labor, Political, and Similar Organizations", "related": [ { "dest-uuid": "88854bc8-3fcb-4ede-a08a-6d0b61adff6b", @@ -48828,7 +48828,7 @@ "value": "8139" }, { - "description": "Business Associations ", + "description": "Business Associations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48849,7 +48849,7 @@ "value": "81391" }, { - "description": "Business Associations ", + "description": "Business Associations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48870,7 +48870,7 @@ "value": "813910" }, { - "description": "Professional Organizations ", + "description": "Professional Organizations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48891,7 +48891,7 @@ "value": "81392" }, { - "description": "Professional Organizations ", + "description": "Professional Organizations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48912,7 +48912,7 @@ "value": "813920" }, { - "description": "Labor Unions and Similar Labor Organizations ", + "description": "Labor Unions and Similar Labor Organizations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48933,7 +48933,7 @@ "value": "81393" }, { - "description": "Labor Unions and Similar Labor Organizations ", + "description": "Labor Unions and Similar Labor Organizations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48954,7 +48954,7 @@ "value": "813930" }, { - "description": "Political Organizations ", + "description": "Political Organizations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48975,7 +48975,7 @@ "value": "81394" }, { - "description": "Political Organizations ", + "description": "Political Organizations", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -48996,7 +48996,7 @@ "value": "813940" }, { - "description": "Other Similar Organizations (except Business, Professional, Labor, and Political Organizations) ", + "description": "Other Similar Organizations (except Business, Professional, Labor, and Political Organizations)", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -49017,7 +49017,7 @@ "value": "81399" }, { - "description": "Other Similar Organizations (except Business, Professional, Labor, and Political Organizations) ", + "description": "Other Similar Organizations (except Business, Professional, Labor, and Political Organizations)", "related": [ { "dest-uuid": "95445128-416a-4636-9d9b-c2f36f32cf72", @@ -49192,7 +49192,7 @@ "value": "92" }, { - "description": "Executive, Legislative, and Other General Government Support ", + "description": "Executive, Legislative, and Other General Government Support", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -49213,7 +49213,7 @@ "value": "921" }, { - "description": "Executive, Legislative, and Other General Government Support ", + "description": "Executive, Legislative, and Other General Government Support", "related": [ { "dest-uuid": "8c336a3c-bd15-48d8-baf4-3b320c5da96b", @@ -49311,7 +49311,7 @@ "value": "9211" }, { - "description": "Executive Offices ", + "description": "Executive Offices", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49332,7 +49332,7 @@ "value": "92111" }, { - "description": "Executive Offices ", + "description": "Executive Offices", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49353,7 +49353,7 @@ "value": "921110" }, { - "description": "Legislative Bodies ", + "description": "Legislative Bodies", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49374,7 +49374,7 @@ "value": "92112" }, { - "description": "Legislative Bodies ", + "description": "Legislative Bodies", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49395,7 +49395,7 @@ "value": "921120" }, { - "description": "Public Finance Activities ", + "description": "Public Finance Activities", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49416,7 +49416,7 @@ "value": "92113" }, { - "description": "Public Finance Activities ", + "description": "Public Finance Activities", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49437,7 +49437,7 @@ "value": "921130" }, { - "description": "Executive and Legislative Offices, Combined ", + "description": "Executive and Legislative Offices, Combined", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49458,7 +49458,7 @@ "value": "92114" }, { - "description": "Executive and Legislative Offices, Combined ", + "description": "Executive and Legislative Offices, Combined", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49479,7 +49479,7 @@ "value": "921140" }, { - "description": "American Indian and Alaska Native Tribal Governments ", + "description": "American Indian and Alaska Native Tribal Governments", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49500,7 +49500,7 @@ "value": "92115" }, { - "description": "American Indian and Alaska Native Tribal Governments ", + "description": "American Indian and Alaska Native Tribal Governments", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49521,7 +49521,7 @@ "value": "921150" }, { - "description": "Other General Government Support ", + "description": "Other General Government Support", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49542,7 +49542,7 @@ "value": "92119" }, { - "description": "Other General Government Support ", + "description": "Other General Government Support", "related": [ { "dest-uuid": "e211e0e8-e420-4561-a61b-0989ae8f175d", @@ -49563,7 +49563,7 @@ "value": "921190" }, { - "description": "Justice, Public Order, and Safety Activities ", + "description": "Justice, Public Order, and Safety Activities", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -49584,7 +49584,7 @@ "value": "922" }, { - "description": "Justice, Public Order, and Safety Activities ", + "description": "Justice, Public Order, and Safety Activities", "related": [ { "dest-uuid": "cbc86963-622b-4754-943d-4889c52024e9", @@ -49696,7 +49696,7 @@ "value": "9221" }, { - "description": "Courts ", + "description": "Courts", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49717,7 +49717,7 @@ "value": "92211" }, { - "description": "Courts ", + "description": "Courts", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49738,7 +49738,7 @@ "value": "922110" }, { - "description": "Police Protection ", + "description": "Police Protection", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49759,7 +49759,7 @@ "value": "92212" }, { - "description": "Police Protection ", + "description": "Police Protection", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49780,7 +49780,7 @@ "value": "922120" }, { - "description": "Legal Counsel and Prosecution ", + "description": "Legal Counsel and Prosecution", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49801,7 +49801,7 @@ "value": "92213" }, { - "description": "Legal Counsel and Prosecution ", + "description": "Legal Counsel and Prosecution", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49822,7 +49822,7 @@ "value": "922130" }, { - "description": "Correctional Institutions ", + "description": "Correctional Institutions", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49843,7 +49843,7 @@ "value": "92214" }, { - "description": "Correctional Institutions ", + "description": "Correctional Institutions", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49864,7 +49864,7 @@ "value": "922140" }, { - "description": "Parole Offices and Probation Offices ", + "description": "Parole Offices and Probation Offices", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49885,7 +49885,7 @@ "value": "92215" }, { - "description": "Parole Offices and Probation Offices ", + "description": "Parole Offices and Probation Offices", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49906,7 +49906,7 @@ "value": "922150" }, { - "description": "Fire Protection ", + "description": "Fire Protection", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49927,7 +49927,7 @@ "value": "92216" }, { - "description": "Fire Protection ", + "description": "Fire Protection", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49948,7 +49948,7 @@ "value": "922160" }, { - "description": "Other Justice, Public Order, and Safety Activities ", + "description": "Other Justice, Public Order, and Safety Activities", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49969,7 +49969,7 @@ "value": "92219" }, { - "description": "Other Justice, Public Order, and Safety Activities ", + "description": "Other Justice, Public Order, and Safety Activities", "related": [ { "dest-uuid": "beaf66db-08af-4338-acde-74aac4838dc1", @@ -49990,7 +49990,7 @@ "value": "922190" }, { - "description": "Administration of Human Resource Programs ", + "description": "Administration of Human Resource Programs", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -50011,7 +50011,7 @@ "value": "923" }, { - "description": "Administration of Human Resource Programs ", + "description": "Administration of Human Resource Programs", "related": [ { "dest-uuid": "ab992529-7c7b-453b-871e-2f823242fda4", @@ -50081,7 +50081,7 @@ "value": "9231" }, { - "description": "Administration of Education Programs ", + "description": "Administration of Education Programs", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50102,7 +50102,7 @@ "value": "92311" }, { - "description": "Administration of Education Programs ", + "description": "Administration of Education Programs", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50123,7 +50123,7 @@ "value": "923110" }, { - "description": "Administration of Public Health Programs ", + "description": "Administration of Public Health Programs", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50144,7 +50144,7 @@ "value": "92312" }, { - "description": "Administration of Public Health Programs ", + "description": "Administration of Public Health Programs", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50165,7 +50165,7 @@ "value": "923120" }, { - "description": "Administration of Human Resource Programs (except Education, Public Health, and Veterans' Affairs Programs) ", + "description": "Administration of Human Resource Programs (except Education, Public Health, and Veterans' Affairs Programs)", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50186,7 +50186,7 @@ "value": "92313" }, { - "description": "Administration of Human Resource Programs (except Education, Public Health, and Veterans' Affairs Programs) ", + "description": "Administration of Human Resource Programs (except Education, Public Health, and Veterans' Affairs Programs)", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50207,7 +50207,7 @@ "value": "923130" }, { - "description": "Administration of Veterans' Affairs ", + "description": "Administration of Veterans' Affairs", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50228,7 +50228,7 @@ "value": "92314" }, { - "description": "Administration of Veterans' Affairs ", + "description": "Administration of Veterans' Affairs", "related": [ { "dest-uuid": "5c77829e-6727-4e53-b79b-bd053ae7b0af", @@ -50249,7 +50249,7 @@ "value": "923140" }, { - "description": "Administration of Environmental Quality Programs ", + "description": "Administration of Environmental Quality Programs", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -50270,7 +50270,7 @@ "value": "924" }, { - "description": "Administration of Environmental Quality Programs ", + "description": "Administration of Environmental Quality Programs", "related": [ { "dest-uuid": "4b8b200a-1cf1-4ea6-a751-6020730980f6", @@ -50312,7 +50312,7 @@ "value": "9241" }, { - "description": "Administration of Air and Water Resource and Solid Waste Management Programs ", + "description": "Administration of Air and Water Resource and Solid Waste Management Programs", "related": [ { "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", @@ -50333,7 +50333,7 @@ "value": "92411" }, { - "description": "Administration of Air and Water Resource and Solid Waste Management Programs ", + "description": "Administration of Air and Water Resource and Solid Waste Management Programs", "related": [ { "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", @@ -50354,7 +50354,7 @@ "value": "924110" }, { - "description": "Administration of Conservation Programs ", + "description": "Administration of Conservation Programs", "related": [ { "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", @@ -50375,7 +50375,7 @@ "value": "92412" }, { - "description": "Administration of Conservation Programs ", + "description": "Administration of Conservation Programs", "related": [ { "dest-uuid": "1f266b9f-cd84-47e1-8779-11e4be7e1670", @@ -50396,7 +50396,7 @@ "value": "924120" }, { - "description": "Administration of Housing Programs, Urban Planning, and Community Development ", + "description": "Administration of Housing Programs, Urban Planning, and Community Development", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -50417,7 +50417,7 @@ "value": "925" }, { - "description": "Administration of Housing Programs, Urban Planning, and Community Development ", + "description": "Administration of Housing Programs, Urban Planning, and Community Development", "related": [ { "dest-uuid": "6e0eb260-7cef-4720-bdc0-3e4e588d1a2d", @@ -50459,7 +50459,7 @@ "value": "9251" }, { - "description": "Administration of Housing Programs ", + "description": "Administration of Housing Programs", "related": [ { "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", @@ -50480,7 +50480,7 @@ "value": "92511" }, { - "description": "Administration of Housing Programs ", + "description": "Administration of Housing Programs", "related": [ { "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", @@ -50501,7 +50501,7 @@ "value": "925110" }, { - "description": "Administration of Urban Planning and Community and Rural Development ", + "description": "Administration of Urban Planning and Community and Rural Development", "related": [ { "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", @@ -50522,7 +50522,7 @@ "value": "92512" }, { - "description": "Administration of Urban Planning and Community and Rural Development ", + "description": "Administration of Urban Planning and Community and Rural Development", "related": [ { "dest-uuid": "8e1dccb1-702a-4434-ae14-e1695a3bb3e7", @@ -50543,7 +50543,7 @@ "value": "925120" }, { - "description": "Administration of Economic Programs ", + "description": "Administration of Economic Programs", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -50564,7 +50564,7 @@ "value": "926" }, { - "description": "Administration of Economic Programs ", + "description": "Administration of Economic Programs", "related": [ { "dest-uuid": "dfbe5f1e-c71c-4dee-898e-d6052949e1e5", @@ -50648,7 +50648,7 @@ "value": "9261" }, { - "description": "Administration of General Economic Programs ", + "description": "Administration of General Economic Programs", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50669,7 +50669,7 @@ "value": "92611" }, { - "description": "Administration of General Economic Programs ", + "description": "Administration of General Economic Programs", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50690,7 +50690,7 @@ "value": "926110" }, { - "description": "Regulation and Administration of Transportation Programs ", + "description": "Regulation and Administration of Transportation Programs", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50711,7 +50711,7 @@ "value": "92612" }, { - "description": "Regulation and Administration of Transportation Programs ", + "description": "Regulation and Administration of Transportation Programs", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50732,7 +50732,7 @@ "value": "926120" }, { - "description": "Regulation and Administration of Communications, Electric, Gas, and Other Utilities ", + "description": "Regulation and Administration of Communications, Electric, Gas, and Other Utilities", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50753,7 +50753,7 @@ "value": "92613" }, { - "description": "Regulation and Administration of Communications, Electric, Gas, and Other Utilities ", + "description": "Regulation and Administration of Communications, Electric, Gas, and Other Utilities", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50774,7 +50774,7 @@ "value": "926130" }, { - "description": "Regulation of Agricultural Marketing and Commodities ", + "description": "Regulation of Agricultural Marketing and Commodities", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50795,7 +50795,7 @@ "value": "92614" }, { - "description": "Regulation of Agricultural Marketing and Commodities ", + "description": "Regulation of Agricultural Marketing and Commodities", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50816,7 +50816,7 @@ "value": "926140" }, { - "description": "Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors ", + "description": "Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50837,7 +50837,7 @@ "value": "92615" }, { - "description": "Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors ", + "description": "Regulation, Licensing, and Inspection of Miscellaneous Commercial Sectors", "related": [ { "dest-uuid": "cec99861-302f-4000-a362-5356ca6a9076", @@ -50858,7 +50858,7 @@ "value": "926150" }, { - "description": "Space Research and Technology ", + "description": "Space Research and Technology", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -50879,7 +50879,7 @@ "value": "927" }, { - "description": "Space Research and Technology ", + "description": "Space Research and Technology", "related": [ { "dest-uuid": "f0560215-6aad-44fa-94ef-443d5cb3d2e2", @@ -50907,7 +50907,7 @@ "value": "9271" }, { - "description": "Space Research and Technology ", + "description": "Space Research and Technology", "related": [ { "dest-uuid": "561dd159-0dfb-4a54-b7e8-489dce89645f", @@ -50928,7 +50928,7 @@ "value": "92711" }, { - "description": "Space Research and Technology ", + "description": "Space Research and Technology", "related": [ { "dest-uuid": "561dd159-0dfb-4a54-b7e8-489dce89645f", @@ -50949,7 +50949,7 @@ "value": "927110" }, { - "description": "National Security and International Affairs ", + "description": "National Security and International Affairs", "related": [ { "dest-uuid": "e6ded46a-1ebe-415a-a808-338b247933f0", @@ -50970,7 +50970,7 @@ "value": "928" }, { - "description": "National Security and International Affairs ", + "description": "National Security and International Affairs", "related": [ { "dest-uuid": "29dc02b0-0ecf-42e5-a8ff-8d4015bea751", @@ -51012,7 +51012,7 @@ "value": "9281" }, { - "description": "National Security ", + "description": "National Security", "related": [ { "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", @@ -51033,7 +51033,7 @@ "value": "92811" }, { - "description": "National Security ", + "description": "National Security", "related": [ { "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", @@ -51054,7 +51054,7 @@ "value": "928110" }, { - "description": "International Affairs ", + "description": "International Affairs", "related": [ { "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", @@ -51075,7 +51075,7 @@ "value": "92812" }, { - "description": "International Affairs ", + "description": "International Affairs", "related": [ { "dest-uuid": "433d2887-752b-43dd-a7a1-263e26abb291", From 25d62c80946fc23c9520e0e58a821a9addfd7567 Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 30 Oct 2023 15:31:24 +0100 Subject: [PATCH 13/20] add categ --- clusters/naics.json | 1 + 1 file changed, 1 insertion(+) diff --git a/clusters/naics.json b/clusters/naics.json index 9c61cea..de46b5b 100644 --- a/clusters/naics.json +++ b/clusters/naics.json @@ -1,4 +1,5 @@ { + "category": "sector", "description": "The North American Industry Classification System or NAICS is a classification of business establishments by type of economic activity (the process of production).", "name": "NAICS", "source": "North American Industry Classification System - NAICS", From b2a5700414f856dff336cedad27f578c74226421 Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 30 Oct 2023 15:43:34 +0100 Subject: [PATCH 14/20] add authors --- clusters/naics.json | 3 +++ 1 file changed, 3 insertions(+) diff --git a/clusters/naics.json b/clusters/naics.json index de46b5b..b6c9d75 100644 --- a/clusters/naics.json +++ b/clusters/naics.json @@ -5,6 +5,9 @@ "source": "North American Industry Classification System - NAICS", "type": "naics", "uuid": "b73ecad4-6529-4625-8c4f-ee3ef703a72a", + "authors": [ + "Executive Office of the President Office of Management and Budget" + ], "values": [ { "description": "Agriculture, Forestry, Fishing and Hunting", From 2436c6f32620d883e990831534e0456f98bd3a84 Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Mon, 30 Oct 2023 15:46:07 +0100 Subject: [PATCH 15/20] jq --- clusters/naics.json | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/clusters/naics.json b/clusters/naics.json index b6c9d75..1f2613f 100644 --- a/clusters/naics.json +++ b/clusters/naics.json @@ -1,13 +1,13 @@ { + "authors": [ + "Executive Office of the President Office of Management and Budget" + ], "category": "sector", "description": "The North American Industry Classification System or NAICS is a classification of business establishments by type of economic activity (the process of production).", "name": "NAICS", "source": "North American Industry Classification System - NAICS", "type": "naics", "uuid": "b73ecad4-6529-4625-8c4f-ee3ef703a72a", - "authors": [ - "Executive Office of the President Office of Management and Budget" - ], "values": [ { "description": "Agriculture, Forestry, Fishing and Hunting", From 38afdbb80f04cfd9f6b3aea012f2ffa3c15d701e Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 31 Oct 2023 08:32:58 +0100 Subject: [PATCH 16/20] fix: [aics] namespace added --- galaxies/naics.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/galaxies/naics.json b/galaxies/naics.json index 116eec0..b2f361e 100644 --- a/galaxies/naics.json +++ b/galaxies/naics.json @@ -2,7 +2,7 @@ "description": "North American Industry Classification System - NAICS", "icon": "industry", "name": "NAICS", - "namespace": "", + "namespace": "misp", "type": "naics", "uuid": "b73ecad4-6529-4625-8c4f-ee3ef703a72a", "version": 1 From e7ca55277c666ff80415fd48194d8820d6dd3c88 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 31 Oct 2023 09:05:19 +0100 Subject: [PATCH 17/20] new: [threat-actor] Storm-0558 added + Fix #880 --- clusters/threat-actor.json | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/clusters/threat-actor.json b/clusters/threat-actor.json index 80133a3..d97d664 100644 --- a/clusters/threat-actor.json +++ b/clusters/threat-actor.json @@ -12059,7 +12059,29 @@ }, "uuid": "9ee446fd-b0cd-4662-9cd1-a60b429192db", "value": "Camaro Dragon" + }, + { + "description": "Storm-0558 is a China-based threat actor with espionage objectives. While there are some minimal overlaps with other Chinese groups such as Violet Typhoon (ZIRCONIUM, APT31), Microsoft maintain high confidence that Storm-0558 operates as its own distinct group", + "meta": { + "attribution-confidence": "50", + "cfr-suspected-state-sponsor": "China", + "cfr-suspected-victims": [ + "United States" + ], + "cfr-target-category": [ + "Government" + ], + "cfr-type-of-incident": "Espionage", + "country": "CN", + "references": [ + "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/", + "https://www.wiz.io/blog/storm-0558-compromised-microsoft-key-enables-authentication-of-countless-micr", + "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/" + ] + }, + "uuid": "5b30bcb8-4923-45cc-bc89-29651ca5d54e", + "value": "Storm-0558" } ], - "version": 287 + "version": 288 } From 648261d42379c2bb8980918f2fd28c0321c413ee Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 31 Oct 2023 09:13:30 +0100 Subject: [PATCH 18/20] fix: [malpedia] restore original MISP UUID for the cluster --- clusters/malpedia.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/clusters/malpedia.json b/clusters/malpedia.json index d6d9cd4..f9cbe2d 100644 --- a/clusters/malpedia.json +++ b/clusters/malpedia.json @@ -13,7 +13,7 @@ "name": "Malpedia", "source": "Malpedia", "type": "malpedia", - "uuid": "5fc98d08-90a4-498a-ad2e-0edf50ef374e", + "uuid": "1d1c9af9-37fa-4deb-a928-f9b0abc7354a", "values": [ { "description": "", From 68903b5ce76b659f75243f85ef9f853c597b7e4f Mon Sep 17 00:00:00 2001 From: Delta-Sierra Date: Tue, 31 Oct 2023 11:40:20 +0100 Subject: [PATCH 19/20] add naics generation script --- tools/generate_naics_clusters.py | 101 +++++++++++++++++++++++++++++++ 1 file changed, 101 insertions(+) create mode 100644 tools/generate_naics_clusters.py diff --git a/tools/generate_naics_clusters.py b/tools/generate_naics_clusters.py new file mode 100644 index 0000000..9f488e1 --- /dev/null +++ b/tools/generate_naics_clusters.py @@ -0,0 +1,101 @@ +#!/usr/bin/env python3 +# -*- coding: utf-8 -*- + +#Used to generate naics galaxy clusters; takes naics.csv as entry +#naics.csv is extract from [2022]_NAICS_Structure.xlsx and only uses the 2022 NAICS Code and 2022 NAICS Title columns, without title. +#Note 1 : This only generate the file for the "clusters" folder +#Note 2 : The generated file needs to pass the jq_all_the_thigs.sh script to be in the corresponding information +#Note 3 : New uuids are generated on every run + +import json +import csv +import uuid + +galaxy={} +galaxy['description']="The North American Industry Classification System or NAICS is a classification of business establishments by type of economic activity (the process of production)." +galaxy['name']="NAICS" +galaxy['source']="North American Industry Classification System - NAICS" +galaxy['type']="naics" +galaxy['uuid']="b73ecad4-6529-4625-8c4f-ee3ef703a72a" +galaxy['version']=2022 #Change when updating +galaxy['authors']=[] +galaxy['authors'].append("Executive Office of the President Office of Management and Budget") +galaxy['category']="sector" + +values = [] + +with open('naics.csv', newline='') as csvfile: + reader = csv.reader(csvfile, delimiter=',', quotechar='"') + for row in reader: + #Cluster creation + cluster = {} + cluster['value']=row[0] + cluster['description']=row[1].strip() + cluster['uuid']=str(uuid.uuid4()) + cluster['related']=[] + + values.append(cluster) + + #Relationsship preparation (Yes it's crappy but at least it works as intended ¯\_(ツ)_/¯) + relationparent={} + relationparent['tags']=[] + relationparent['tags'].append("estimative-language:likelihood-probability=\"likely\"") + relationparent['type']="parent-of" + + relationchild={} + relationchild['tags']=[] + relationchild['tags'].append("estimative-language:likelihood-probability=\"likely\"") + relationchild['type']="child-of" + + relationsiblings={} + relationsiblings['tags']=[] + relationsiblings['tags'].append("estimative-language:likelihood-probability=\"likely\"") + relationsiblings['type']="similar" + + relationsiblings2={} + relationsiblings2['tags']=[] + relationsiblings2['tags'].append("estimative-language:likelihood-probability=\"likely\"") + relationsiblings2['type']="similar" + + #Building relationships + if len(cluster['value']) > 2: #2 digit codes have no parents + if len(cluster['value']) == 6: #specific case of 6 digit codes, parent have only 4 digits + for value in values: + if value['value'] == cluster['value'][0:len(cluster['value'])-2]: + relationchild['dest-uuid']=value['uuid'] + cluster['related'].append(relationchild) + + relationparent['dest-uuid']=cluster['uuid'] + value['related'].append(relationparent) + break + + if cluster['value'][5] == "0": #If a 6 digit code ends with 0, it has a similar/identical 5 digit code + for value in values: + if value['value'] == cluster['value'][0:len(cluster['value'])-1]: + relationsiblings['dest-uuid']=value['uuid'] + cluster['related'].append(relationsiblings) + + relationsiblings2['dest-uuid']=cluster['uuid'] + value['related'].append(relationsiblings2) + break + + + + else: #All other cases (codes with 3 to 5 digits) + for value in values: + if value['value'] == cluster['value'][0:len(cluster['value'])-1]: + relationchild['dest-uuid']=value['uuid'] + cluster['related'].append(relationchild) + + relationparent['dest-uuid']=cluster['uuid'] + value['related'].append(relationparent) + break + + + +galaxy['values']=values + +tojson = json.dumps(galaxy, indent=2) +jsonFile = open("naisc_cluster.json", "w") +jsonFile.write(tojson) +jsonFile.close() From 852f205c752633dedf9bc915a09892983fdae839 Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Tue, 31 Oct 2023 18:04:23 +0100 Subject: [PATCH 20/20] chg: [mitre-attack] updated to ATT&CK v14.0 Enterprise --- clusters/mitre-attack-pattern.json | 1212 ++++++++-- clusters/mitre-course-of-action.json | 360 ++- clusters/mitre-intrusion-set.json | 1784 ++++++++++++++- clusters/mitre-malware.json | 3122 +++++++++++++++++++++++++- clusters/mitre-tool.json | 361 ++- 5 files changed, 6556 insertions(+), 283 deletions(-) diff --git a/clusters/mitre-attack-pattern.json b/clusters/mitre-attack-pattern.json index ca66d8d..277f4d8 100644 --- a/clusters/mitre-attack-pattern.json +++ b/clusters/mitre-attack-pattern.json @@ -378,7 +378,15 @@ "https://attack.mitre.org/techniques/T1445" ] }, - "related": [], + "related": [ + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "51aedbd6-2837-4d15-aeb0-cb09f2bf22ac", "value": "Abuse of iOS Enterprise App Signing Key - T1445" }, @@ -618,7 +626,7 @@ "value": "Identify vulnerabilities in third-party software libraries - T1389" }, { - "description": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\n\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\Users\\\\[Username]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup. The startup folder path for all users is C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp.\n\nThe following run keys are created by default on Windows systems:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nThe following Registry keys can be used to set startup folder items for persistence:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell subkeys can automatically launch programs.\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run when any user logs on.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.", + "description": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.(Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\n\nThe following run keys are created by default on Windows systems:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nRun keys may exist under multiple hives.(Citation: Microsoft Wow6432Node 2018)(Citation: Malwarebytes Wow6432Node 2016) The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency.(Citation: Microsoft Run Key) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nPlacing a program within a startup folder will also cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in. The startup folder path for the current user is C:\\Users\\\\[Username]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup. The startup folder path for all users is C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp.\n\nThe following Registry keys can be used to set startup folder items for persistence:\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run automatically for the currently logged-on user.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.", "meta": { "external_id": "T1547.001", "kill_chain": [ @@ -684,7 +692,7 @@ "value": "Clear Linux or Mac System Logs - T1070.002" }, { - "description": "Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.\n\nNetwork connection history may be stored in various locations on a system. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\n\nWindows may also store information about recent RDP connections in files such as C:\\Users\\\\%username%\\Documents\\Default.rdp and `C:\\Users\\%username%\\AppData\\Local\\Microsoft\\Terminal\nServer Client\\Cache\\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)\n\nMalicious network connections may also require changes to network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.", + "description": "Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations. Configuration settings as well as various artifacts that highlight connection history may be created on a system and/or in application logs from behaviors that require network connections, such as [Remote Services](https://attack.mitre.org/techniques/T1021) or [External Remote Services](https://attack.mitre.org/techniques/T1133). Defenders may use these artifacts to monitor or otherwise analyze network connections created by adversaries.\n\nNetwork connection history may be stored in various locations. For example, RDP connection history may be stored in Windows Registry values under (Citation: Microsoft RDP Removal):\n\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Servers\n\nWindows may also store information about recent RDP connections in files such as C:\\Users\\\\%username%\\Documents\\Default.rdp and `C:\\Users\\%username%\\AppData\\Local\\Microsoft\\Terminal\nServer Client\\Cache\\`.(Citation: Moran RDPieces) Similarly, macOS and Linux hosts may store information highlighting connection history in system logs (such as those stored in `/Library/Logs` and/or `/var/log/`).(Citation: Apple Culprit Access)(Citation: FreeDesktop Journal)(Citation: Apple Unified Log Analysis Remote Login and Screen Sharing)\n\nMalicious network connections may also require changes to third-party applications or network configuration settings, such as [Disable or Modify System Firewall](https://attack.mitre.org/techniques/T1562/004) or tampering to enable [Proxy](https://attack.mitre.org/techniques/T1090). Adversaries may delete or modify this data to conceal indicators and/or impede defensive analysis.", "meta": { "external_id": "T1070.007", "kill_chain": [ @@ -816,7 +824,7 @@ "value": "Compromise Software Dependencies and Development Tools - T1474.001" }, { - "description": "Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. Adversaries may place a program in an earlier entry in the list of directories stored in the PATH environment variable, which Windows will then execute when it searches sequentially through that PATH listing in search of the binary that was called from a script or the command line.\n\nThe PATH environment variable contains a list of directories. Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given. If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\\system32 (e.g., C:\\Windows\\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.\n\nFor example, if C:\\example path precedes C:\\Windows\\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\\example path will be called instead of the Windows system \"net\" when \"net\" is executed from the command-line.", + "description": "Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries. The PATH environment variable contains a list of directories (User and System) that the OS searches sequentially through in search of the binary that was called from a script or the command line. \n\nAdversaries can place a malicious program in an earlier entry in the list of directories stored in the PATH environment variable, resulting in the operating system executing the malicious binary rather than the legitimate binary when it searches sequentially through that PATH listing.\n\nFor example, on Windows if an adversary places a malicious program named \"net.exe\" in `C:\\example path`, which by default precedes `C:\\Windows\\system32\\net.exe` in the PATH environment variable, when \"net\" is executed from the command-line the `C:\\example path` will be called instead of the system's legitimate executable at `C:\\Windows\\system32\\net.exe`. Some methods of executing a program rely on the PATH environment variable to determine the locations that are searched when the path for the program is not given, such as executing programs from a [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059).(Citation: ExpressVPN PATH env Windows 2021)\n\nAdversaries may also directly modify the $PATH variable specifying the directories to be searched. An adversary can modify the `$PATH` variable to point to a directory they have write access. When a program using the $PATH variable is called, the OS searches the specified directory and executes the malicious binary. On macOS, this can also be performed through modifying the $HOME variable. These variables can be modified using the command-line, launchctl, [Unix Shell Configuration Modification](https://attack.mitre.org/techniques/T1546/004), or modifying the `/etc/paths.d` folder contents.(Citation: uptycs Fake POC linux malware 2023)(Citation: nixCraft macOS PATH variables)(Citation: Elastic Rules macOS launchctl 2022)", "meta": { "external_id": "T1574.007", "kill_chain": [ @@ -830,10 +838,16 @@ "Windows Registry: Windows Registry Key Modification" ], "mitre_platforms": [ - "Windows" + "Windows", + "macOS", + "Linux" ], "refs": [ - "https://attack.mitre.org/techniques/T1574/007" + "https://attack.mitre.org/techniques/T1574/007", + "https://www.cyberciti.biz/faq/appleosx-bash-unix-change-set-path-environment-variable/", + "https://www.elastic.co/guide/en/security/7.17/prebuilt-rule-7-16-4-modification-of-environment-variable-via-launchctl.html", + "https://www.expressvpn.com/blog/cybersecurity-lessons-a-path-vulnerability-in-windows/", + "https://www.uptycs.com/blog/new-poc-exploit-backdoor-malware" ] }, "related": [ @@ -879,6 +893,40 @@ "uuid": "58af3705-8740-4c68-9329-ec015a7013c2", "value": "Path Interception by Search Order Hijacking - T1574.008" }, + { + "description": "Adversaries may disable or modify the Linux audit system to hide malicious activity and avoid detection. Linux admins use the Linux Audit system to track security-relevant information on a system. The Linux Audit system operates at the kernel-level and maintains event logs on application and system activity such as process, network, file, and login events based on pre-configured rules.\n\nOften referred to as `auditd`, this is the name of the daemon used to write events to disk and is governed by the parameters set in the `audit.conf` configuration file. Two primary ways to configure the log generation rules are through the command line `auditctl` utility and the file `/etc/audit/audit.rules`, containing a sequence of `auditctl` commands loaded at boot time.(Citation: Red Hat System Auditing)(Citation: IzyKnows auditd threat detection 2022)\n\nWith root privileges, adversaries may be able to ensure their activity is not logged through disabling the Audit system service, editing the configuration/rule files, or by hooking the Audit system library functions. Using the command line, adversaries can disable the Audit system service through killing processes associated with `auditd` daemon or use `systemctl` to stop the Audit service. Adversaries can also hook Audit system functions to disable logging or modify the rules contained in the `/etc/audit/audit.rules` or `audit.conf` files to ignore malicious activity.(Citation: Trustwave Honeypot SkidMap 2023)(Citation: ESET Ebury Feb 2014)", + "meta": { + "external_id": "T1562.012", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Command: Command Execution", + "File: File Deletion", + "File: File Modification", + "Process: OS API Execution", + "Process: Process Modification" + ], + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/chap-system_auditing", + "https://attack.mitre.org/techniques/T1562/012", + "https://izyknows.medium.com/linux-auditd-for-threat-detection-d06c8b941505", + "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/honeypot-recon-new-variant-of-skidmap-targeting-redis/", + "https://www.welivesecurity.com/2014/02/21/an-in-depth-analysis-of-linuxebury/" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "562e9b64-7239-493d-80f4-2bff900d9054", + "value": "Disable or Modify Linux Audit System - T1562.012" + }, { "description": "Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the \"run keys\" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. (Citation: Microsoft Run Key) These programs will be executed under the context of the user and will have the account's associated permissions level.\n\nPlacing a program within a startup folder will cause that program to execute when a user logs in. There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in.\n\nThe startup folder path for the current user is:\n* C:\\Users\\[Username]\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\nThe startup folder path for all users is:\n* C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\n\nThe following run keys are created by default on Windows systems:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\n\nThe HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx is also available but is not created by default on Windows Vista and newer. Registry run key entries can reference programs directly or list them as a dependency. (Citation: Microsoft RunOnceEx APR 2018) For example, it is possible to load a DLL at logon using a \"Depend\" key with RunOnceEx: reg add HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnceEx\\0001\\Depend /v 1 /d \"C:\\temp\\evil[.]dll\" (Citation: Oddvar Moe RunOnceEx Mar 2018)\n\nThe following Registry keys can be used to set startup folder items for persistence:\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\n* HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\n\nThe following Registry keys can control automatic startup of services during boot:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServicesOnce\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunServices\n\nUsing policy settings to specify startup programs creates corresponding values in either of two Registry keys:\n* HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n* HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\n\nThe Winlogon key controls actions that occur when a user logs on to a computer running Windows 7. Most of these actions are under the control of the operating system, but you can also add custom actions here. The HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit and HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell subkeys can automatically launch programs.\n\nPrograms listed in the load value of the registry key HKEY_CURRENT_USER\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows run when any user logs on.\n\nBy default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Session Manager is set to autocheck autochk *. This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally. Adversaries can add other programs or processes to this registry value which will automatically launch at boot.\n\nAdversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make the Registry entries look as if they are associated with legitimate programs.", "meta": { @@ -1039,7 +1087,15 @@ "https://attack.mitre.org/techniques/T1441" ] }, - "related": [], + "related": [ + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "a21a6a79-f9a1-4c87-aed9-ba2d79536881", "value": "Stolen Developer Credentials or Signing Keys - T1441" }, @@ -1522,6 +1578,7 @@ "mitre_data_sources": [ "File: File Metadata", "Image: Image Metadata", + "Process: Process Creation", "Process: Process Metadata" ], "mitre_platforms": [ @@ -1531,10 +1588,10 @@ "Containers" ], "refs": [ - "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf", "https://attack.mitre.org/techniques/T1036/005", "https://docs.docker.com/engine/reference/commandline/images/", - "https://twitter.com/ItsReallyNick/status/1055321652777619457" + "https://twitter.com/ItsReallyNick/status/1055321652777619457", + "https://www.elastic.co/blog/how-hunt-masquerade-ball" ] }, "related": [ @@ -1546,6 +1603,32 @@ "uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", "value": "Match Legitimate Name or Location - T1036.005" }, + { + "description": "Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them. This is done for the sake of evading defenses and observation. This may be done by giving artifacts the name and icon of a legitimate, trusted application (i.e., Settings), or using a package name that matches legitimate, trusted applications (i.e., `com.google.android.gm`). \n\nAdversaries may also use the same icon of the file or application they are trying to mimic.\n", + "meta": { + "external_id": "T1655.001", + "kill_chain": [ + "mitre-mobile-attack:defense-evasion" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1655/001", + "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-14.html", + "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html" + ] + }, + "related": [ + { + "dest-uuid": "f856eaab-e84a-4265-a8a2-7bf37e5dc2fc", + "type": "subtechnique-of" + } + ], + "uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "value": "Match Legitimate Name or Location - T1655.001" + }, { "description": "Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.\n\nModifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed. For example, adversaries may add a new firewall rule for a well-known protocol (such as RDP) using a non-traditional and potentially less securitized port (i.e. [Non-Standard Port](https://attack.mitre.org/techniques/T1571)).(Citation: change_rdp_port_conti)", "meta": { @@ -1607,6 +1690,45 @@ "uuid": "77532a55-c283-4cd2-bc5d-2d0b65e9d88c", "value": "Disable or Modify Cloud Firewall - T1562.007" }, + { + "description": "An adversary may disable or modify cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable or modify logging to avoid detection of their activities.\n\nFor example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic) They may alternatively tamper with logging functionality – for example, by removing any associated SNS topics, disabling multi-region logging, or disabling settings that validate and/or encrypt log files.(Citation: AWS Update Trail)(Citation: Pacu Detection Disruption Module) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the `Set-MailboxAuditBypassAssociation` cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading Microsoft 365 Attacks 2021)", + "meta": { + "external_id": "T1562.008", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Cloud Service: Cloud Service Disable", + "Cloud Service: Cloud Service Modification", + "User Account: User Account Modification" + ], + "mitre_platforms": [ + "IaaS", + "SaaS", + "Google Workspace", + "Azure AD", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1562/008", + "https://awscli.amazonaws.com/v2/documentation/api/latest/reference/cloudtrail/update-trail.html", + "https://cloud.google.com/logging/docs/audit/configure-data-access", + "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html", + "https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_delete", + "https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/", + "https://github.com/RhinoSecurityLabs/pacu/blob/master/pacu/modules/detection__disruption/main.py", + "https://www.darkreading.com/threat-intelligence/incident-responders-explore-microsoft-365-attacks-in-the-wild/d/d-id/1341591" + ] + }, + "related": [ + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "type": "subtechnique-of" + } + ], + "uuid": "cacc40da-4c9e-462c-80d5-fd70a178b12d", + "value": "Disable or Modify Cloud Logs - T1562.008" + }, { "description": "Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. In user mode, Windows Authenticode (Citation: Microsoft Authenticode) digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe). The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, (Citation: Microsoft WinVerifyTrust) which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. (Citation: SpectorOps Subverting Trust Sept 2017)\n\nBecause of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) (Citation: EduardosBlog SIPs July 2008) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats (Executable, PowerShell, Installer, etc., with catalog signing providing a catch-all (Citation: Microsoft Catalog Files and Signatures April 2017)) and are identified by globally unique identifiers (GUIDs). (Citation: SpectorOps Subverting Trust Sept 2017)\n\nSimilar to [Code Signing](https://attack.mitre.org/techniques/T1553/002), adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system. Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by: (Citation: SpectorOps Subverting Trust Sept 2017)\n\n* Modifying the Dll and FuncName Registry values in HKLM\\SOFTWARE[\\WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllGetSignedDataMsg\\{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP (Citation: GitHub SIP POC Sept 2017) (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).\n* Modifying the Dll and FuncName Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\OID\\EncodingType 0\\CryptSIPDllVerifyIndirectData\\{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP (Citation: GitHub SIP POC Sept 2017) (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.\n* Modifying the DLL and Function Registry values in HKLM\\SOFTWARE\\[WOW6432Node\\]Microsoft\\Cryptography\\Providers\\Trust\\FinalPolicy\\{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).\n* **Note:** The above hijacks are also possible without modifying the Registry via [DLL Search Order Hijacking](https://attack.mitre.org/techniques/T1574/001).\n\nHijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. (Citation: SpectorOps Subverting Trust Sept 2017)", "meta": { @@ -2174,7 +2296,8 @@ "File: File Access", "Network Share: Network Share Access", "Network Traffic: Network Connection Creation", - "Network Traffic: Network Traffic Content" + "Network Traffic: Network Traffic Content", + "Network Traffic: Network Traffic Flow" ], "mitre_platforms": [ "Linux", @@ -2301,7 +2424,15 @@ "https://attack.mitre.org/techniques/T1431" ] }, - "related": [], + "related": [ + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "6b846ad0-cc20-4db6-aa34-91561397c5e2", "value": "App Delivered via Web Download - T1431" }, @@ -2662,7 +2793,15 @@ "https://attack.mitre.org/techniques/T1434" ] }, - "related": [], + "related": [ + { + "dest-uuid": "53263a67-075e-48fa-974b-91c5b5445db7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "1f96d624-8409-4472-ad8a-30618ee6b2e2", "value": "App Delivered via Email Attachment - T1434" }, @@ -3282,7 +3421,8 @@ "mitre_data_sources": [ "Command: Command Execution", "File: File Deletion", - "Process: OS API Execution" + "Process: OS API Execution", + "Process: Process Creation" ], "mitre_platforms": [ "Windows" @@ -3372,6 +3512,37 @@ "uuid": "68a0c5ed-bee2-4513-830d-5b0d650139bd", "value": "Distributed Component Object Model - T1021.003" }, + { + "description": "Adversaries may leverage [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log directly into accessible cloud hosted compute infrastructure through cloud native methods. Many cloud providers offer interactive connections to virtual infrastructure that can be accessed through the [Cloud API](https://attack.mitre.org/techniques/T1059/009), such as Azure Serial Console(Citation: Azure Serial Console), AWS EC2 Instance Connect(Citation: EC2 Instance Connect)(Citation: lucr-3: Getting SaaS-y in the cloud), and AWS System Manager.(Citation: AWS System Manager).\n\nMethods of authentication for these connections can include passwords, application access tokens, or SSH keys. These cloud native methods may, by default, allow for privileged access on the host with SYSTEM or root level access. \n\nAdversaries may utilize these cloud native methods to directly access virtual infrastructure and pivot through an environment.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console) These connections typically provide direct console access to the VM rather than the execution of scripts (i.e., [Cloud Administration Command](https://attack.mitre.org/techniques/T1651)).", + "meta": { + "external_id": "T1021.008", + "kill_chain": [ + "mitre-attack:lateral-movement" + ], + "mitre_data_sources": [ + "Logon Session: Logon Session Creation" + ], + "mitre_platforms": [ + "IaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1021/008", + "https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-connect-methods.html", + "https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html", + "https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/serial-console-overview", + "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud", + "https://www.mandiant.com/resources/blog/sim-swapping-abuse-azure-serial" + ] + }, + "related": [ + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "type": "subtechnique-of" + } + ], + "uuid": "45241b9e-9bbc-4826-a2cc-78855e51ca09", + "value": "Direct Cloud VM Connections - T1021.008" + }, { "description": "An adversary may use access to cloud services (e.g. Google's Android Device Manager or Apple iCloud's Find my iPhone) or to an enterprise mobility management (EMM)/mobile device management (MDM) server console to track the location of mobile devices managed by the service.(Citation: Krebs-Location) ", "meta": { @@ -3463,7 +3634,8 @@ "meta": { "external_id": "T1098.002", "kill_chain": [ - "mitre-attack:persistence" + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "Application Log: Application Log Content", @@ -3561,6 +3733,39 @@ "uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "value": "Archive via Custom Method - T1560.003" }, + { + "description": "An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)\n \nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. \n\nNote that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003).", + "meta": { + "external_id": "T1098.006", + "kill_chain": [ + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" + ], + "mitre_data_sources": [ + "User Account: User Account Modification" + ], + "mitre_platforms": [ + "Containers" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1098/006", + "https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters", + "https://cloud.google.com/kubernetes-engine/docs/how-to/iam", + "https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html", + "https://kubernetes.io/docs/concepts/security/rbac-good-practices/", + "https://kubernetes.io/docs/reference/access-authn-authz/abac/", + "https://learn.microsoft.com/en-us/azure/aks/concepts-identity" + ] + }, + "related": [ + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "type": "subtechnique-of" + } + ], + "uuid": "35d30338-5bfa-41b0-a170-ec06dfd75f64", + "value": "Additional Container Cluster Roles - T1098.006" + }, { "description": "Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process. \n\nBefore creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).(Citation: Microsoft Window Classes) Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class. This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value. (Citation: Microsoft GetWindowLong function) (Citation: Microsoft SetWindowLong function)\n\nAlthough small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure. Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.\n\nExecution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges. Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.(Citation: Elastic Process Injection July 2017) More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process. (Citation: MalwareTech Power Loader Aug 2013) (Citation: WeLiveSecurity Gapz and Redyms Mar 2013)\n\nRunning code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process. ", "meta": { @@ -3651,7 +3856,7 @@ "value": "Code Signing Policy Modification - T1632.001" }, { - "description": "Adversaries may execute their own malicious payloads by hijacking the way an operating system run applications. Hijacking execution flow can be for the purposes of persistence since this hijacked execution may reoccur at later points in time. \n\n\nOn Android, adversaries may overwrite the standard OS API library with a malicious alternative to hook into core functions to achieve persistence. By doing this, the adversary’s code will be executed every time the overwritten API function is called by an app on the infected device.", + "description": "Adversaries may execute their own malicious payloads by hijacking the way an operating system runs applications. Hijacking execution flow can be for the purposes of persistence since this hijacked execution may reoccur at later points in time. \n\n\nOn Android, adversaries may overwrite the standard OS API library with a malicious alternative to hook into core functions to achieve persistence. By doing this, the adversary’s code will be executed every time the overwritten API function is called by an app on the infected device.", "meta": { "external_id": "T1625.001", "kill_chain": [ @@ -3675,7 +3880,7 @@ "value": "System Runtime API Hijacking - T1625.001" }, { - "description": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)\n\nAdversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) \n\nAdversaries may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) \n\nIn cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.\n\nFurthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)\n\nAdditionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)", + "description": "Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.(Citation: SCADAfence_ransomware)\n\nAdversaries may also tamper with artifacts deployed and utilized by security tools. Security tools may make dynamic changes to system components in order to maintain visibility into specific events. For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection. Similar to [Indicator Blocking](https://attack.mitre.org/techniques/T1562/006), adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.(Citation: OutFlank System Calls)(Citation: MDSec System Calls) \n\nAdversaries may also focus on specific applications such as Sysmon. For example, the “Start” and “Enable” values in HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WMI\\Autologger\\EventLog-Microsoft-Windows-Sysmon-Operational may be modified to tamper with and potentially disable Sysmon logging.(Citation: disable_win_evt_logging) \n\nOn network devices, adversaries may attempt to skip digital signature verification checks by altering startup configuration files and effectively disabling firmware verification that typically occurs at boot.(Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)(Citation: Analysis of FG-IR-22-369)\n\nIn cloud environments, tools disabled by adversaries may include cloud monitoring agents that report back to services such as AWS CloudWatch or Google Cloud Monitor.\n\nFurthermore, although defensive tools may have anti-tampering mechanisms, adversaries may abuse tools such as legitimate rootkit removal kits to impair and/or disable these tools.(Citation: chasing_avaddon_ransomware)(Citation: dharma_ransomware)(Citation: demystifying_ryuk)(Citation: doppelpaymer_crowdstrike) For example, adversaries have used tools such as GMER to find and shut down hidden processes and antivirus software on infected systems.(Citation: demystifying_ryuk)\n\nAdditionally, adversaries may exploit legitimate drivers from anti-virus software to gain access to kernel space (i.e. [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068)), which may lead to bypassing anti-tampering features.(Citation: avoslocker_ransomware)", "meta": { "external_id": "T1562.001", "kill_chain": [ @@ -3684,6 +3889,7 @@ "mitre_data_sources": [ "Command: Command Execution", "Driver: Driver Load", + "Process: Process Creation", "Process: Process Termination", "Sensor Health: Host Status", "Service: Service Metadata", @@ -3695,7 +3901,8 @@ "macOS", "Linux", "Containers", - "IaaS" + "IaaS", + "Network" ], "refs": [ "https://attack.mitre.org/techniques/T1562/001", @@ -3706,6 +3913,8 @@ "https://thehackernews.com/2022/05/avoslocker-ransomware-variant-using-new.html", "https://www.crowdstrike.com/blog/how-doppelpaymer-hunts-and-kills-windows-processes/", "https://www.crowdstrike.com/blog/targeted-dharma-ransomware-intrusions-exhibit-consistent-techniques/", + "https://www.fortinet.com/blog/psirt-blogs/fg-ir-22-369-psirt-analysis", + "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem", "https://www.mandiant.com/resources/chasing-avaddon-ransomware", "https://www.mdsec.co.uk/2020/12/bypassing-user-mode-hooks-and-direct-invocation-of-system-calls-for-red-teams/" ] @@ -4014,7 +4223,8 @@ "Process: Process Creation", "Script: Script Execution", "Sensor Health: Host Status", - "Windows Registry: Windows Registry Key Creation" + "Windows Registry: Windows Registry Key Creation", + "Windows Registry: Windows Registry Key Modification" ], "mitre_platforms": [ "Windows" @@ -4519,6 +4729,43 @@ "uuid": "2bee5ffb-7a7a-4119-b1f2-158151b19ac0", "value": "Application or System Exploitation - T1499.004" }, + { + "description": "Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto resources and services, or otherwise gain short-term access to a set of privileges that may be distinct from their own. \n\nJust-in-time access is a mechanism for granting additional roles to cloud accounts in a granular, temporary manner. This allows accounts to operate with only the permissions they need on a daily basis, and to request additional permissions as necessary. Sometimes just-in-time access requests are configured to require manual approval, while other times the desired permissions are automatically granted.(Citation: Google Cloud Just in Time Access 2023)(Citation: Azure Just in Time Access 2023)\n\nAccount impersonation allows user or service accounts to temporarily act with the permissions of another account. For example, in GCP users with the `iam.serviceAccountTokenCreator` role can create temporary access tokens or sign arbitrary payloads with the permissions of a service account.(Citation: Google Cloud Service Account Authentication Roles) In Exchange Online, the `ApplicationImpersonation` role allows a service account to use the permissions associated with specified user accounts.(Citation: Microsoft Impersonation and EWS in Exchange) \n\nMany cloud environments also include mechanisms for users to pass roles to resources that allow them to perform tasks and authenticate to other services. While the user that creates the resource does not directly assume the role they pass to it, they may still be able to take advantage of the role's access -- for example, by configuring the resource to perform certain actions with the permissions it has been granted. In AWS, users with the `PassRole` permission can allow a service they create to assume a given role, while in GCP, users with the `iam.serviceAccountUser` role can attach a service account to a resource.(Citation: AWS PassRole)(Citation: Google Cloud Service Account Authentication Roles)\n\nWhile users require specific role assignments in order to use any of these features, cloud administrators may misconfigure permissions. This could result in escalation paths that allow adversaries to gain access to resources beyond what was originally intended.(Citation: Rhino Google Cloud Privilege Escalation)(Citation: Rhino Security Labs AWS Privilege Escalation)\n\n**Note:** this technique is distinct from [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003), which involves assigning permanent roles to accounts rather than abusing existing permissions structures to gain temporarily elevated access to resources. However, adversaries that compromise a sufficiently privileged account may grant another account they control [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) that would allow them to also abuse these features. This may also allow for greater stealth than would be had by directly using the highly privileged account, especially when logs do not clarify when role impersonation is taking place.(Citation: CrowdStrike StellarParticle January 2022)", + "meta": { + "external_id": "T1548.005", + "kill_chain": [ + "mitre-attack:privilege-escalation", + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "User Account: User Account Modification" + ], + "mitre_platforms": [ + "IaaS", + "Azure AD", + "Office 365" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1548/005", + "https://cloud.google.com/architecture/manage-just-in-time-privileged-access-to-project", + "https://cloud.google.com/iam/docs/service-account-permissions", + "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html", + "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/approve-just-in-time-access", + "https://learn.microsoft.com/en-us/exchange/client-developer/exchange-web-services/impersonation-and-ews-in-exchange", + "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", + "https://rhinosecuritylabs.com/gcp/privilege-escalation-google-cloud-platform-part-1/", + "https://www.crowdstrike.com/blog/observations-from-the-stellarparticle-campaign/" + ] + }, + "related": [ + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "type": "subtechnique-of" + } + ], + "uuid": "6fa224c7-5091-4595-bf15-3fc9fe2f2c7c", + "value": "Temporary Elevated Cloud Access - T1548.005" + }, { "description": "Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming) \n\nWhen used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0).(Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.(Citation: iDefense Rootkit Overview)\n\nKernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through kextload and kextunload commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.(Citation: System and kernel extensions in macOS)\n\nSince macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as \"Legacy System Extensions\" since there is no System Extension for Kernel Programming Interfaces.(Citation: Apple Kernel Extension Deprecation)\n\nAdversaries can use LKMs and kexts to conduct [Persistence](https://attack.mitre.org/tactics/TA0003) and/or [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) on a system. Examples have been found in the wild, and there are some relevant open source projects as well.(Citation: Volatility Phalanx2)(Citation: CrowdStrike Linux Rootkit)(Citation: GitHub Reptile)(Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle)(Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir)(Citation: Trend Micro Skidmap)", "meta": { @@ -4569,6 +4816,67 @@ "uuid": "a1b52199-c8c5-438a-9ded-656f1d0888c6", "value": "Kernel Modules and Extensions - T1547.006" }, + { + "description": "Adversaries may acquire credentials from cloud-native secret management solutions such as AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, and Terraform Vault. \n\nSecrets managers support the secure centralized management of passwords, API keys, and other credential material. Where secrets managers are in use, cloud services can dynamically acquire credentials via API requests rather than accessing secrets insecurely stored in plain text files or environment variables. \n\nIf an adversary is able to gain sufficient privileges in a cloud environment – for example, by obtaining the credentials of high-privileged [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004) or compromising a service that has permission to retrieve secrets – they may be able to request secrets from the secrets manager. This can be accomplished via commands such as `get-secret-value` in AWS, `gcloud secrets describe` in GCP, and `az key vault secret show` in Azure.(Citation: Permiso Scattered Spider 2023)(Citation: Sysdig ScarletEel 2.0 2023)(Citation: AWS Secrets Manager)(Citation: Google Cloud Secrets)(Citation: Microsoft Azure Key Vault)\n\n**Note:** this technique is distinct from [Cloud Instance Metadata API](https://attack.mitre.org/techniques/T1552/005) in that the credentials are being directly requested from the cloud secrets manager, rather than through the medium of the instance metadata API.", + "meta": { + "external_id": "T1555.006", + "kill_chain": [ + "mitre-attack:credential-access" + ], + "mitre_data_sources": [ + "Cloud Service: Cloud Service Enumeration" + ], + "mitre_platforms": [ + "IaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1555/006", + "https://cloud.google.com/secret-manager/docs/view-secret-details", + "https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets.html", + "https://learn.microsoft.com/en-us/azure/key-vault/secrets/quick-create-cli", + "https://permiso.io/blog/lucr-3-scattered-spider-getting-saas-y-in-the-cloud", + "https://sysdig.com/blog/scarleteel-2-0/" + ] + }, + "related": [ + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "type": "subtechnique-of" + } + ], + "uuid": "cfb525cc-5494-401d-a82b-2539ca46a561", + "value": "Cloud Secrets Management Stores - T1555.006" + }, + { + "description": "Adversaries may modify settings that directly affect the size, locations, and resources available to cloud compute infrastructure in order to evade defenses. These settings may include service quotas, subscription associations, tenant-wide policies, or other configurations that impact available compute. Such modifications may allow adversaries to abuse the victim’s compute resources to achieve their goals, potentially without affecting the execution of running instances and/or revealing their activities to the victim.\n\nFor example, cloud providers often limit customer usage of compute resources via quotas. Customers may request adjustments to these quotas to support increased computing needs, though these adjustments may require approval from the cloud provider. Adversaries who compromise a cloud environment may similarly request quota adjustments in order to support their activities, such as enabling additional [Resource Hijacking](https://attack.mitre.org/techniques/T1496) without raising suspicion by using up a victim’s entire quota.(Citation: Microsoft Cryptojacking 2023) Adversaries may also increase allowed resource usage by modifying any tenant-wide policies that limit the sizes of deployed virtual machines.(Citation: Microsoft Azure Policy)\n\nAdversaries may also modify settings that affect where cloud resources can be deployed, such as enabling [Unused/Unsupported Cloud Regions](https://attack.mitre.org/techniques/T1535). In Azure environments, an adversary who has gained access to a Global Administrator account may create new subscriptions in which to deploy resources, or engage in subscription hijacking by transferring an existing pay-as-you-go subscription from a victim tenant to an adversary-controlled tenant.(Citation: Microsoft Peach Sandstorm 2023) This will allow the adversary to use the victim’s compute resources without generating logs on the victim tenant.(Citation: Microsoft Azure Policy) (Citation: Microsoft Subscription Hijacking 2022)", + "meta": { + "external_id": "T1578.005", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Cloud Service: Cloud Service Modification" + ], + "mitre_platforms": [ + "IaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1578/005", + "https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#compute", + "https://techcommunity.microsoft.com/t5/microsoft-365-defender-blog/hunt-for-compromised-azure-subscriptions-using-microsoft/ba-p/3607121", + "https://www.microsoft.com/en-us/security/blog/2023/07/25/cryptojacking-understanding-and-defending-against-cloud-compute-resource-abuse/", + "https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/" + ] + }, + "related": [ + { + "dest-uuid": "144e007b-e638-431d-a894-45d90c54ab90", + "type": "subtechnique-of" + } + ], + "uuid": "ca00366b-83a1-4c7b-a0ce-8ff950a7c87f", + "value": "Modify Cloud Compute Configurations - T1578.005" + }, { "description": "Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services. Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts. Windows stores local service configuration information in the Registry under HKLM\\SYSTEM\\CurrentControlSet\\Services. The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe, [PowerShell](https://attack.mitre.org/techniques/T1059/001), or [Reg](https://attack.mitre.org/software/S0075). Access to Registry keys is controlled through access control lists and user permissions. (Citation: Registry Key Security)(Citation: malware_hides_service)\n\nIf the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control. When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).\n\nAdversaries may also alter other Registry keys in the service’s Registry tree. For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.(Citation: Kansa Service related collectors)(Citation: Tweet Registry Perms Weakness)\n\nThe Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.(Citation: microsoft_services_registry_tree) If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.(Citation: insecure_reg_perms)\n\nAdversaries may also add the Parameters key, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.(Citation: microsoft_services_registry_tree)(Citation: troj_zegost) Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified using HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\servicename\\Parameters\\ServiceDll.(Citation: malware_hides_service)", "meta": { @@ -5131,7 +5439,7 @@ "value": "Credentials from Web Browsers - T1503" }, { - "description": "Adversaries may access data from improperly secured cloud storage.\n\nMany cloud service providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. These solutions differ from other storage solutions (such as SQL or Elasticsearch) in that there is no overarching application. Data from these solutions can be retrieved directly using the cloud provider's APIs. \n\nIn other cases, SaaS application providers such as Slack, Confluence, and Salesforce also provide cloud storage solutions as a peripheral use case of their platform. These cloud objects can be extracted directly from their associated application.(Citation: EA Hacked via Slack - June 2021)(Citation: SecureWorld - How Secure Is Your Slack Channel - Dec 2021)(Citation: HackerNews - 3 SaaS App Cyber Attacks - April 2022)(Citation: Dark Clouds_Usenix_Mulazzani_08_2011)\n\nAdversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.\n\nThis open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021)\n\nAdversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects.", + "description": "Adversaries may access data from cloud storage.\n\nMany IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. \n\nIn some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the [Cloud API](https://attack.mitre.org/techniques/T1059/009). In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., [Data from Information Repositories](https://attack.mitre.org/techniques/T1213)). \n\nAdversaries may collect sensitive data from these cloud storage solutions. Providers typically offer security guides to help end users configure systems, though misconfigurations are a common problem.(Citation: Amazon S3 Security, 2019)(Citation: Microsoft Azure Storage Security, 2019)(Citation: Google Cloud Storage Best Practices, 2019) There have been numerous incidents where cloud storage has been improperly secured, typically by unintentionally allowing public access to unauthenticated users, overly-broad access by all users, or even access for any anonymous person outside the control of the Identity Access Management system without even needing basic user permissions.\n\nThis open access may expose various types of sensitive data, such as credit cards, personally identifiable information, or medical records.(Citation: Trend Micro S3 Exposed PII, 2017)(Citation: Wired Magecart S3 Buckets, 2019)(Citation: HIPAA Journal S3 Breach, 2017)(Citation: Rclone-mega-extortion_05_2021)\n\nAdversaries may also obtain then abuse leaked credentials from source repositories, logs, or other means as a way to gain access to cloud storage objects.", "meta": { "external_id": "T1530", "kill_chain": [ @@ -5142,7 +5450,9 @@ ], "mitre_platforms": [ "IaaS", - "SaaS" + "SaaS", + "Google Workspace", + "Office 365" ], "refs": [ "https://attack.mitre.org/techniques/T1530", @@ -5150,12 +5460,8 @@ "https://cloud.google.com/storage/docs/best-practices", "https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide", "https://redcanary.com/blog/rclone-mega-extortion/", - "https://thehackernews.com/2022/04/into-breach-breaking-down-3-saas-app.html", "https://www.hipaajournal.com/47gb-medical-records-unsecured-amazon-s3-bucket/", - "https://www.secureworld.io/industry-news/how-secure-is-your-slack-channel#:~:text=Electronic%20Arts%20hacked%20through%20Slack%20channel&text=In%20total%2C%20the%20hackers%20claim,credentials%20over%20a%20Slack%20channel.", - "https://www.techradar.com/news/ea-hack-reportedly-used-stolen-cookies-and-slack-to-hack-gaming-giant", "https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia", - "https://www.usenix.org/conference/usenix-security-11/dark-clouds-horizon-using-cloud-storage-attack-vector-and-online-slack", "https://www.wired.com/story/magecart-amazon-cloud-hacks/" ] }, @@ -5265,12 +5571,20 @@ "https://attack.mitre.org/techniques/T1440" ] }, - "related": [], + "related": [ + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "b765efd1-02e6-4e67-aebf-0fef5c37e54b", "value": "Detect App Analysis Environment - T1440" }, { - "description": "Adversaries may exploit software vulnerabilities in order to to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in an application, service, within the operating system software, or kernel itself to execute adversary-controlled code. Security constructions, such as permission levels, will often hinder access to information and use of certain techniques. Adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. \n\nWhen initially gaining access to a device, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and applications running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user- level permission to root permissions depending on the component that is vulnerable. ", + "description": "Adversaries may exploit software vulnerabilities in order to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in an application, service, within the operating system software, or kernel itself to execute adversary-controlled code. Security constructions, such as permission levels, will often hinder access to information and use of certain techniques. Adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions. \n\nWhen initially gaining access to a device, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system. Vulnerabilities may exist, usually in operating system components and applications running at higher permissions, that can be exploited to gain higher levels of access on the system. This could enable someone to move from unprivileged or user- level permission to root permissions depending on the component that is vulnerable. ", "meta": { "external_id": "T1404", "kill_chain": [ @@ -5640,7 +5954,7 @@ "value": "Bypass User Account Control - T1088" }, { - "description": "Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.\n\nAdversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001). The security software will likely be targeted directly for exploitation. There are examples of antivirus software being targeted by persistent threat groups to avoid detection.", + "description": "Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.\n\nAdversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for [Security Software Discovery](https://attack.mitre.org/techniques/T1518/001). The security software will likely be targeted directly for exploitation. There are examples of antivirus software being targeted by persistent threat groups to avoid detection.\n\nThere have also been examples of vulnerabilities in public cloud infrastructure of SaaS applications that may bypass defense boundaries (Citation: Salesforce zero-day in facebook phishing attack), evade security logs (Citation: Bypassing CloudTrail in AWS Service Catalog), or deploy hidden infrastructure.(Citation: GhostToken GCP flaw)", "meta": { "external_id": "T1211", "kill_chain": [ @@ -5653,10 +5967,15 @@ "mitre_platforms": [ "Linux", "Windows", - "macOS" + "macOS", + "SaaS", + "IaaS" ], "refs": [ - "https://attack.mitre.org/techniques/T1211" + "https://attack.mitre.org/techniques/T1211", + "https://securitylabs.datadoghq.com/articles/bypass-cloudtrail-aws-service-catalog-and-other/", + "https://www.bleepingcomputer.com/news/security/ghosttoken-gcp-flaw-let-attackers-backdoor-google-accounts/", + "https://www.bleepingcomputer.com/news/security/hackers-exploited-salesforce-zero-day-in-facebook-phishing-attack/" ] }, "uuid": "fe926152-f431-4baf-956c-4ad3cb0bf23b", @@ -5697,7 +6016,7 @@ "value": "Extra Window Memory Injection - T1181" }, { - "description": "Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain access to systems. One example of this is MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions.(Citation: Technet MS14-068)(Citation: ADSecurity Detecting Forged Tickets) Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.", + "description": "Adversaries may exploit software vulnerabilities in an attempt to collect credentials. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. \n\nCredentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain authenticated access to systems. One example of this is `MS14-068`, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions.(Citation: Technet MS14-068)(Citation: ADSecurity Detecting Forged Tickets) Another example of this is replay attacks, in which the adversary intercepts data packets sent between parties and then later replays these packets. If services don't properly validate authentication requests, these replayed packets may allow an adversary to impersonate one of the parties and gain unauthorized access or privileges.(Citation: Bugcrowd Replay Attack)(Citation: Comparitech Replay Attack)(Citation: Microsoft Midnight Blizzard Replay Attack)\n\nSuch exploitation has been demonstrated in cloud environments as well. For example, adversaries have exploited vulnerabilities in public cloud infrastructure that allowed for unintended authentication token creation and renewal.(Citation: Storm-0558 techniques for unauthorized email access)\n\nExploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.", "meta": { "external_id": "T1212", "kill_chain": [ @@ -5711,12 +6030,17 @@ "mitre_platforms": [ "Linux", "Windows", - "macOS" + "macOS", + "Azure AD" ], "refs": [ "https://adsecurity.org/?p=1515", "https://attack.mitre.org/techniques/T1212", - "https://technet.microsoft.com/en-us/library/security/ms14-068.aspx" + "https://technet.microsoft.com/en-us/library/security/ms14-068.aspx", + "https://twitter.com/MsftSecIntel/status/1671579359994343425", + "https://www.bugcrowd.com/glossary/replay-attack/", + "https://www.comparitech.com/blog/information-security/what-is-a-replay-attack/", + "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/" ] }, "uuid": "9c306d8d-cde7-4b4c-b6e8-d0bb16caca36", @@ -6555,7 +6879,7 @@ "value": "Post compromise tool development - T1353" }, { - "description": "Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.", + "description": "Adversaries may search common password storage locations to obtain user credentials. Passwords can be stored in several places on a device, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users to manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.", "meta": { "external_id": "T1634", "kill_chain": [ @@ -6673,7 +6997,7 @@ "value": "Remote Service Session Hijacking - T1563" }, { - "description": "An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.\n\nCookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)\n\nThere are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as Evilginx 2 and Muraena that can gather session cookies through a malicious proxy (ex: [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)\n\nAfter an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.", + "description": "An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.\n\nCookies are often valid for an extended period of time, even if the web application is not actively used. Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems. Additionally, other applications on the targets machine might store sensitive authentication cookies in memory (e.g. apps which authenticate to cloud services). Session cookies can be used to bypasses some multi-factor authentication protocols.(Citation: Pass The Cookie)\n\nThere are several examples of malware targeting cookies from web browsers on the local system.(Citation: Kaspersky TajMahal April 2019)(Citation: Unit 42 Mac Crypto Cookies January 2019) There are also open source frameworks such as `Evilginx2` and `Muraena` that can gather session cookies through a malicious proxy (ex: [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)) that can be set up by an adversary and used in phishing campaigns.(Citation: Github evilginx2)(Citation: GitHub Mauraena)\n\nAfter an adversary acquires a valid cookie, they can then perform a [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004) technique to login to the corresponding web application.", "meta": { "external_id": "T1539", "kill_chain": [ @@ -6826,7 +7150,7 @@ "value": "Network Denial of Service - T1464" }, { - "description": "Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server. Common client software types are SSH clients, FTP clients, email clients, and web browsers.\n\nAdversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use. For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one. Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.", + "description": "Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server. Common client software types are SSH clients, FTP clients, email clients, and web browsers.\n\nAdversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use. For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one. An adversary may also modify an existing binary by patching in malicious functionality (e.g., IAT Hooking/Entry point patching)(Citation: Unit42 Banking Trojans Hooking 2022) prior to the binary’s legitimate execution. For example, an adversary may modify the entry point of a binary to point to malicious code patched in by the adversary before resuming normal execution flow.(Citation: ESET FontOnLake Analysis 2021)\n\nSince these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.", "meta": { "external_id": "T1554", "kill_chain": [ @@ -6844,7 +7168,9 @@ "Windows" ], "refs": [ - "https://attack.mitre.org/techniques/T1554" + "https://attack.mitre.org/techniques/T1554", + "https://unit42.paloaltonetworks.com/banking-trojan-techniques/#post-125550-_rm3d6xxbk52n", + "https://web-assets.esetstatic.com/wls/2021/10/eset_fontonlake.pdf" ] }, "uuid": "960c3c86-1480-4d72-b4e0-8c242e84a5c5", @@ -6885,12 +7211,17 @@ "Process: OS API Execution", "Process: Process Creation", "Process: Process Metadata", + "User Account: User Account Modification", "Windows Registry: Windows Registry Key Modification" ], "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "Office 365", + "IaaS", + "Google Workspace", + "Azure AD" ], "refs": [ "https://attack.mitre.org/techniques/T1548" @@ -7113,13 +7444,14 @@ "value": "Endpoint Denial of Service - T1499" }, { - "description": "Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications that store passwords to make it easier for users manage and maintain. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.", + "description": "Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.", "meta": { "external_id": "T1555", "kill_chain": [ "mitre-attack:credential-access" ], "mitre_data_sources": [ + "Cloud Service: Cloud Service Enumeration", "Command: Command Execution", "File: File Access", "Process: OS API Execution", @@ -7129,7 +7461,8 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "IaaS" ], "refs": [ "https://attack.mitre.org/techniques/T1555" @@ -7146,6 +7479,7 @@ "mitre-attack:exfiltration" ], "mitre_data_sources": [ + "Application Log: Application Log Content", "Command: Command Execution", "File: File Access", "Network Traffic: Network Connection Creation", @@ -7155,7 +7489,10 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "Office 365", + "SaaS", + "Google Workspace" ], "refs": [ "https://attack.mitre.org/techniques/T1567" @@ -7164,6 +7501,24 @@ "uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", "value": "Exfiltration Over Web Service - T1567" }, + { + "description": "Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to insecure coding practices that can lead to unanticipated behavior. Adversaries may take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility. \n\nAdversaries may use device-based zero-click exploits for code execution. These exploits are powerful because there is no user interaction required for code execution. \n\n### SMS/iMessage Delivery \n\nSMS and iMessage in iOS are common targets through [Drive-By Compromise](https://attack.mitre.org/techniques/T1456), [Phishing](https://attack.mitre.org/techniques/T1660), etc. Adversaries may use embed malicious links, files, etc. in SMS messages or iMessages. Mobile devices may be compromised through one-click exploits, where the victim must interact with a text message, or zero-click exploits, where no user interaction is required. \n\n### AirDrop \n\nUnique to iOS, AirDrop is a network protocol that allows iOS users to transfer files between iOS devices. Before patches from Apple were released, on iOS 13.4 and earlier, adversaries may force the Apple Wireless Direct Link (AWDL) interface to activate, then exploit a buffer overflow to gain access to the device and run as root without interaction from the user. ", + "meta": { + "external_id": "T1658", + "kill_chain": [ + "mitre-mobile-attack:execution" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1658" + ] + }, + "uuid": "5abfc5e6-3c56-49e7-ad72-502d01acf28b", + "value": "Exploitation for Client Execution - T1658" + }, { "description": "Adversaries may search freely available technical databases for information about victims that can be used during targeting. Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.(Citation: WHOIS)(Citation: DNS Dumpster)(Citation: Circl Passive DNS)(Citation: Medium SSL Cert)(Citation: SSLShopper Lookup)(Citation: DigitalShadows CDN)(Citation: Shodan)\n\nAdversaries may search in different open databases depending on what information they seek to gather. Information from these sources may reveal opportunities for other forms of reconnaissance (ex: [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593)), establishing operational resources (ex: [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) or [Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Trusted Relationship](https://attack.mitre.org/techniques/T1199)).", "meta": { @@ -7196,6 +7551,7 @@ "mitre-attack:defense-evasion" ], "mitre_data_sources": [ + "Cloud Service: Cloud Service Metadata", "Instance: Instance Creation", "Instance: Instance Deletion", "Instance: Instance Metadata", @@ -7605,7 +7961,8 @@ "Logon Session: Logon Session Creation", "Network Share: Network Share Access", "Network Traffic: Network Connection Creation", - "Network Traffic: Network Traffic Flow" + "Network Traffic: Network Traffic Flow", + "Process: Process Creation" ], "mitre_platforms": [ "Windows" @@ -7695,6 +8052,7 @@ "mitre_data_sources": [ "Command: Command Execution", "File: File Access", + "File: File Creation", "Windows Registry: Windows Registry Key Access" ], "mitre_platforms": [ @@ -7917,6 +8275,7 @@ ], "mitre_data_sources": [ "Logon Session: Logon Session Creation", + "Logon Session: Logon Session Metadata", "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Flow", "Process: Process Creation" @@ -8070,6 +8429,7 @@ "Command: Command Execution", "Logon Session: Logon Session Creation", "Network Traffic: Network Connection Creation", + "Network Traffic: Network Traffic Flow", "Process: Process Creation", "Service: Service Metadata" ], @@ -8094,7 +8454,7 @@ "value": "Windows Remote Management - T1021.006" }, { - "description": "Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", + "description": "Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server. \n\nProtocols such as SMB, FTP, FTPS, and TFTP that transfer files may be very common in environments. Packets produced from these protocols may have many fields and headers in which data can be concealed. Data could also be concealed within the transferred files. An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic. ", "meta": { "external_id": "T1071.002", "kill_chain": [ @@ -8317,11 +8677,12 @@ "value": "Archive via Utility - T1560.001" }, { - "description": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)\n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. These credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)", + "description": "Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.\n\nFor example, adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.(Citation: Microsoft SolarWinds Customer Guidance)(Citation: Blue Cloud of Death)(Citation: Blue Cloud of Death Video) These credentials include both x509 keys and passwords.(Citation: Microsoft SolarWinds Customer Guidance) With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.(Citation: Demystifying Azure AD Service Principals)\n\nIn infrastructure-as-a-service (IaaS) environments, after gaining access through [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004), adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.(Citation: GCP SSH Key Add) This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.(Citation: Expel IO Evil in AWS)(Citation: Expel Behind the Scenes)\n\nAdversaries may also use the CreateAccessKey API in AWS or the gcloud iam service-accounts keys create command in GCP to add access keys to an account. If the target account has different permissions from the requesting account, the adversary may also be able to escalate their privileges in the environment (i.e. [Cloud Accounts](https://attack.mitre.org/techniques/T1078/004)).(Citation: Rhino Security Labs AWS Privilege Escalation)(Citation: Sysdig ScarletEel 2.0) For example, in Azure AD environments, an adversary with the Application Administrator role can add a new set of credentials to their application's service principal. In doing so the adversary would be able to access the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) \n\nIn AWS environments, adversaries with the appropriate permissions may also use the `sts:GetFederationToken` API call to create a temporary set of credentials tied to the permissions of the original user account. These credentials may remain valid for the duration of their lifetime even if the original account’s API credentials are deactivated.\n(Citation: Crowdstrike AWS User Federation Persistence)", "meta": { "external_id": "T1098.001", "kill_chain": [ - "mitre-attack:persistence" + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "User Account: User Account Modification" @@ -8338,8 +8699,10 @@ "https://expel.io/blog/finding-evil-in-aws/", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/", "https://nedinthecloud.com/2019/07/16/demystifying-azure-ad-service-principals/", + "https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5", "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://speakerdeck.com/tweekfawkes/blue-cloud-of-death-red-teaming-azure-1", + "https://sysdig.com/blog/scarleteel-2-0/", "https://www.crowdstrike.com/blog/how-adversaries-persist-with-aws-user-federation/", "https://www.youtube.com/watch?v=wQ1CuAPnrLM&feature=youtu.be&t=2815" ] @@ -8370,7 +8733,7 @@ "https://attack.mitre.org/techniques/T1430/002", "https://berlin.ccc.de/~tobias/31c3-ss7-locate-track-manipulate.pdf", "https://pages.nist.gov/mobile-threat-catalogue/cellular-threats/CEL-38.html", - "https://www.fcc.gov/files/csric5-wg10-finalreport031517pdf", + "https://web.archive.org/web/20200330012714/https://www.fcc.gov/files/csric5-wg10-finalreport031517pdf", "https://www.ptsecurity.com/upload/ptcom/PT-SS7-AD-Data-Sheet-eng.pdf", "https://www.youtube.com/watch?v=q0n5ySqbfdI" ] @@ -8629,10 +8992,10 @@ "Windows" ], "refs": [ - "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf", "https://attack.mitre.org/techniques/T1036/003", "https://lolbas-project.github.io/", "https://twitter.com/ItsReallyNick/status/1055321652777619457", + "https://www.elastic.co/blog/how-hunt-masquerade-ball", "https://www.f-secure.com/documents/996508/1030745/CozyDuke" ] }, @@ -8973,11 +9336,43 @@ "value": "Masquerade File Type - T1036.008" }, { - "description": "An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)\n(Citation: Microsoft O365 Admin Roles) \n\nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\n\nFor example, in Azure AD environments, an adversary with the Application Administrator role can add [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) to their application's service principal. In doing so the adversary would be able to gain the service principal’s roles and permissions, which may be different from those of the Application Administrator.(Citation: SpecterOps Azure Privilege Escalation) Similarly, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)\n\nSimilarly, an adversary with the Azure AD Global Administrator role can toggle the “Access management for Azure resources” option to gain the ability to assign privileged access to Azure subscriptions and virtual machines to Azure AD users, including themselves.(Citation: Azure AD to AD) ", + "description": "An adversary may attempt to evade process tree-based analysis by modifying executed malware's parent process ID (PPID). If endpoint protection software leverages the “parent-child\" relationship for detection, breaking this relationship could result in the adversary’s behavior not being associated with previous process tree activity. On Unix-based systems breaking this process tree is common practice for administrators to execute software using scripts and programs.(Citation: 3OHA double-fork 2022) \n\nOn Linux systems, adversaries may execute a series of [Native API](https://attack.mitre.org/techniques/T1106) calls to alter malware's process tree. For example, adversaries can execute their payload without any arguments, call the `fork()` API call twice, then have the parent process exit. This creates a grandchild process with no parent process that is immediately adopted by the `init` system process (PID 1), which successfully disconnects the execution of the adversary's payload from its previous process tree.\n\nAnother example is using the “daemon” syscall to detach from the current parent process and run in the background.(Citation: Sandfly BPFDoor 2022)(Citation: Microsoft XorDdos Linux Stealth 2022) ", + "meta": { + "external_id": "T1036.009", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Process: OS API Execution", + "Process: Process Creation" + ], + "mitre_platforms": [ + "Linux", + "macOS" + ], + "refs": [ + "https://0xjet.github.io/3OHA/2022/04/11/post.html", + "https://attack.mitre.org/techniques/T1036/009", + "https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/", + "https://www.microsoft.com/en-us/security/blog/2022/05/19/rise-in-xorddos-a-deeper-look-at-the-stealthy-ddos-malware-targeting-linux-devices/" + ] + }, + "related": [ + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "type": "subtechnique-of" + } + ], + "uuid": "34a80bc4-80f2-46e6-94ff-f3265a4b657c", + "value": "Break Process Trees - T1036.009" + }, + { + "description": "An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.(Citation: AWS IAM Policies and Permissions)(Citation: Google Cloud IAM Policies)(Citation: Microsoft Support O365 Add Another Admin, October 2019)(Citation: Microsoft O365 Admin Roles) With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).(Citation: Expel AWS Attacker)\n(Citation: Microsoft O365 Admin Roles) \n\nThis account modification may immediately follow [Create Account](https://attack.mitre.org/techniques/T1136) or other malicious account activity. Adversaries may also modify existing [Valid Accounts](https://attack.mitre.org/techniques/T1078) that they have compromised. This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.\n\nFor example, in AWS environments, an adversary with appropriate permissions may be able to use the CreatePolicyVersion API to define a new version of an IAM policy or the AttachUserPolicy API to attach an IAM policy with additional or distinct permissions to a compromised user account.(Citation: Rhino Security Labs AWS Privilege Escalation)", "meta": { "external_id": "T1098.003", "kill_chain": [ - "mitre-attack:persistence" + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "User Account: User Account Modification" @@ -8990,13 +9385,11 @@ "Azure AD" ], "refs": [ - "https://adsecurity.org/?p=4277", "https://attack.mitre.org/techniques/T1098/003", "https://cloud.google.com/iam/docs/policies", "https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html", "https://docs.microsoft.com/en-us/office365/admin/add-users/about-admin-roles?view=o365-worldwide", "https://expel.com/blog/incident-report-from-cli-to-console-chasing-an-attacker-in-aws/", - "https://posts.specterops.io/azure-privilege-escalation-via-service-principal-abuse-210ae2be2a5", "https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/", "https://support.office.com/en-us/article/add-another-admin-f693489f-9f55-4bd0-a637-a81ce93de22d" ] @@ -9120,11 +9513,12 @@ "value": "Credential API Hooking - T1056.004" }, { - "description": "Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys.(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd_config.\n\nAdversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account.(Citation: Google Cloud Add Metadata)(Citation: Google Cloud Privilege Escalation) Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API.(Citation: Azure Update Virtual Machines) This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH.(Citation: Venafi SSH Key Abuse)(Citation: Cybereason Linux Exim Worm) \n\nWhere authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. \n\nSSH keys can also be added to accounts on network devices, such as with the `ip ssh pubkey-chain` [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) command.(Citation: cisco_ip_ssh_pubkey_ch_cmd)", + "description": "Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys.(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd_config.\n\nAdversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account.(Citation: Google Cloud Add Metadata)(Citation: Google Cloud Privilege Escalation) Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API.(Citation: Azure Update Virtual Machines) This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH.(Citation: Venafi SSH Key Abuse)(Citation: Cybereason Linux Exim Worm) It may also lead to privilege escalation where the virtual machine or instance has distinct permissions from the requesting user.\n\nWhere authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. \n\nSSH keys can also be added to accounts on network devices, such as with the `ip ssh pubkey-chain` [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) command.(Citation: cisco_ip_ssh_pubkey_ch_cmd)", "meta": { "external_id": "T1098.004", "kill_chain": [ - "mitre-attack:persistence" + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "Command: Command Execution", @@ -9347,6 +9741,7 @@ "mitre-attack:collection" ], "mitre_data_sources": [ + "Application Log: Application Log Content", "Command: Command Execution", "Logon Session: Logon Session Creation", "Network Traffic: Network Connection Creation" @@ -9389,7 +9784,7 @@ "https://docs.microsoft.com/previous-versions/windows/desktop/htmlhelp/microsoft-html-help-1-4-sdk", "https://msdn.microsoft.com/windows/desktop/ms524405", "https://msdn.microsoft.com/windows/desktop/ms644670", - "https://msitpros.com/?p=3909", + "https://oddvar.moe/2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/", "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8625" ] }, @@ -9714,6 +10109,35 @@ "uuid": "ed730f20-0e44-48b9-85f8-0e2adeb76867", "value": "Determine Physical Locations - T1591.001" }, + { + "description": "Adversaries may smuggle commands to download malicious payloads past content filters by hiding them within otherwise seemingly benign windows shortcut files. Windows shortcut files (.LNK) include many metadata fields, including an icon location field (also known as the `IconEnvironmentDataBlock`) designed to specify the path to an icon file that is to be displayed for the LNK file within a host directory. \n\nAdversaries may abuse this LNK metadata to download malicious payloads. For example, adversaries have been observed using LNK files as phishing payloads to deliver malware. Once invoked (e.g., [Malicious File](https://attack.mitre.org/techniques/T1204/002)), payloads referenced via external URLs within the LNK icon location field may be downloaded. These files may also then be invoked by [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)/[System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218) arguments within the target path field of the LNK.(Citation: Unprotect Shortcut)(Citation: Booby Trap Shortcut 2017)\n\nLNK Icon Smuggling may also be utilized post compromise, such as malicious scripts executing an LNK on an infected host to download additional malicious payloads. \n", + "meta": { + "external_id": "T1027.012", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "File: File Creation", + "File: File Metadata" + ], + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1027/012", + "https://unprotect.it/technique/shortcut-hiding/", + "https://www.uperesia.com/booby-trapped-shortcut" + ] + }, + "related": [ + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "type": "subtechnique-of" + } + ], + "uuid": "887274fc-2d63-4bdc-82f3-fae56d1d5fdc", + "value": "LNK Icon Smuggling - T1027.012" + }, { "description": "Adversaries may mimic common operating system GUI components to prompt users for sensitive information with a seemingly legitimate prompt. The operating system and installed applications often have legitimate needs to prompt the user for sensitive information such as account credentials, bank account information, or Personally Identifiable Information (PII). Compared to traditional PCs, the constrained display size of mobile devices may impair the ability to provide users with contextual information, making users more susceptible to this technique’s use.(Citation: Felt-PhishingOnMobileDevices)\n\nThere are several approaches adversaries may use to mimic this functionality. Adversaries may impersonate the identity of a legitimate application (e.g. use the same application name and/or icon) and, when installed on the device, may prompt the user for sensitive information.(Citation: eset-finance) Adversaries may also send fake device notifications to the user that may trigger the display of an input prompt when clicked.(Citation: Group IB Gustuff Mar 2019) \n\nAdditionally, adversaries may display a prompt on top of a running, legitimate application to trick users into entering sensitive information into a malicious application rather than the legitimate application. Typically, adversaries need to know when the targeted application and the individual activity within the targeted application is running in the foreground to display the prompt at the proper time. Adversaries can abuse Android’s accessibility features to determine which application is currently in the foreground.(Citation: ThreatFabric Cerberus) Two known approaches to displaying a prompt include:\n\n* Adversaries start a new activity on top of a running legitimate application.(Citation: Felt-PhishingOnMobileDevices)(Citation: Hassell-ExploitingAndroid) Android 10 places new restrictions on the ability for an application to start a new activity on top of another application, which may make it more difficult for adversaries to utilize this technique.(Citation: Android Background)\n* Adversaries create an application overlay window on top of a running legitimate application. Applications must hold the `SYSTEM_ALERT_WINDOW` permission to create overlay windows. This permission is handled differently than typical Android permissions and, at least under certain conditions, is automatically granted to applications installed from the Google Play Store.(Citation: Cloak and Dagger)(Citation: NowSecure Android Overlay)(Citation: Skycure-Accessibility) The `SYSTEM_ALERT_WINDOW` permission and its associated ability to create application overlay windows are expected to be deprecated in a future release of Android in favor of a new API.(Citation: XDA Bubbles)", "meta": { @@ -9759,7 +10183,8 @@ ], "mitre_data_sources": [ "Command: Command Execution", - "File: File Access" + "File: File Access", + "Process: Process Creation" ], "mitre_platforms": [ "Windows", @@ -9879,7 +10304,7 @@ "value": "Suppress Application Icon - T1628.001" }, { - "description": "Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application. In earlier versions of Android, device administrator applications needed their administration capabilities explicitly deactivated by the user before the application could be uninstalled. This was later updated so the user could deactivate and uninstall the administrator application in one step.\n\nAdversaries may also abuse the device accessibility APIs to prevent removal. This set of APIs allows the application to perform certain actions on behalf of the user and programmatically determine what is being shown on the screen. The malicious application could monitor the device screen for certain modals (e.g., the confirmation modal to uninstall an application) and inject screen input or a back button tap to close the modal.", + "description": "Adversaries may abuse the Android device administration API to prevent the user from uninstalling a target application. In earlier versions of Android, device administrator applications needed their administration capabilities explicitly deactivated by the user before the application could be uninstalled. This was later updated so the user could deactivate and uninstall the administrator application in one step.\n\nAdversaries may also abuse the device accessibility APIs to prevent removal. This set of APIs allows the application to perform certain actions on behalf of the user and programmatically determine what is being shown on the screen. The malicious application could monitor the device screen for certain modals (e.g., the confirmation modal to uninstall an application) and inject screen input or a back button tap to close the modal. For example, Android's `performGlobalAction(int)` API could be utilized to prevent the user from removing the malicious application from the device after installation. If the user wants to uninstall the malicious application, two cases may occur, both preventing the user from removing the application.\n\n* Case 1: If the integer argument passed to the API call is `2` or `GLOBAL_ACTION_HOME`, the malicious application may direct the user to the home screen from settings screen \n\n* Case 2: If the integer argument passed to the API call is `1` or `GLOBAL_ACTION_BACK`, the malicious application may emulate the back press event ", "meta": { "external_id": "T1629.001", "kill_chain": [ @@ -10742,43 +11167,6 @@ "uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", "value": "Domain Generation Algorithms - T1568.002" }, - { - "description": "An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection. Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment. If an adversary has sufficient permissions, they can disable logging to avoid detection of their activities.\n\nFor example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.(Citation: Following the CloudTrail: Generating strong AWS security signals with Sumo Logic) In Office 365, an adversary may disable logging on mail collection activities for specific users by using the `Set-MailboxAuditBypassAssociation` cmdlet, by disabling M365 Advanced Auditing for the user, or by downgrading the user’s license from an Enterprise E5 to an Enterprise E3 license.(Citation: Dark Reading Microsoft 365 Attacks 2021)", - "meta": { - "external_id": "T1562.008", - "kill_chain": [ - "mitre-attack:defense-evasion" - ], - "mitre_data_sources": [ - "Cloud Service: Cloud Service Disable", - "Cloud Service: Cloud Service Modification", - "User Account: User Account Modification" - ], - "mitre_platforms": [ - "IaaS", - "SaaS", - "Google Workspace", - "Azure AD", - "Office 365" - ], - "refs": [ - "https://attack.mitre.org/techniques/T1562/008", - "https://cloud.google.com/logging/docs/audit/configure-data-access", - "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/stop-cloudtrail-from-sending-events-to-cloudwatch-logs.html", - "https://docs.microsoft.com/en-us/cli/azure/monitor/diagnostic-settings?view=azure-cli-latest#az_monitor_diagnostic_settings_delete", - "https://expel.io/blog/following-cloudtrail-generating-aws-security-signals-sumo-logic/", - "https://www.darkreading.com/threat-intelligence/incident-responders-explore-microsoft-365-attacks-in-the-wild/d/d-id/1341591" - ] - }, - "related": [ - { - "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", - "type": "subtechnique-of" - } - ], - "uuid": "cacc40da-4c9e-462c-80d5-fd70a178b12d", - "value": "Disable Cloud Logs - T1562.008" - }, { "description": "Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.(Citation: Microsoft Safe Mode)(Citation: Sophos Snatch Ransomware 2019)\n\nAdversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot. Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.(Citation: Microsoft bcdedit 2021)\n\nAdversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values (i.e. [Modify Registry](https://attack.mitre.org/techniques/T1112)). Malicious [Component Object Model](https://attack.mitre.org/techniques/T1559/001) (COM) objects may also be registered and loaded in safe mode.(Citation: Sophos Snatch Ransomware 2019)(Citation: CyberArk Labs Safe Mode 2016)(Citation: Cybereason Nocturnus MedusaLocker 2020)(Citation: BleepingComputer REvil 2021)", "meta": { @@ -11542,6 +11930,48 @@ "uuid": "633a100c-b2c9-41bf-9be5-905c1b16c825", "value": "Dynamic Linker Hijacking - T1574.006" }, + { + "description": "Adversaries may exfiltrate data to a webhook endpoint rather than over their primary command and control channel. Webhooks are simple mechanisms for allowing a server to push data over HTTP/S to a client without the need for the client to continuously poll the server.(Citation: RedHat Webhooks) Many public and commercial services, such as Discord, Slack, and `webhook.site`, support the creation of webhook endpoints that can be used by other services, such as Github, Jira, or Trello.(Citation: Discord Intro to Webhooks) When changes happen in the linked services (such as pushing a repository update or modifying a ticket), these services will automatically post the data to the webhook endpoint for use by the consuming application. \n\nAdversaries may link an adversary-owned environment to a victim-owned SaaS service to achieve repeated [Automated Exfiltration](https://attack.mitre.org/techniques/T1020) of emails, chat messages, and other data.(Citation: Push Security SaaS Attacks Repository Webhooks) Alternatively, instead of linking the webhook endpoint to a service, an adversary can manually post staged data directly to the URL in order to exfiltrate it.(Citation: Microsoft SQL Server)\n\nAccess to webhook endpoints is often over HTTPS, which gives the adversary an additional level of protection. Exfiltration leveraging webhooks can also blend in with normal network traffic if the webhook endpoint points to a commonly used SaaS application or collaboration service.(Citation: CyberArk Labs Discord)(Citation: Talos Discord Webhook Abuse)(Citation: Checkmarx Webhooks)", + "meta": { + "external_id": "T1567.004", + "kill_chain": [ + "mitre-attack:exfiltration" + ], + "mitre_data_sources": [ + "Application Log: Application Log Content", + "Command: Command Execution", + "File: File Access", + "Network Traffic: Network Traffic Content", + "Network Traffic: Network Traffic Flow" + ], + "mitre_platforms": [ + "Windows", + "macOS", + "Linux", + "SaaS", + "Office 365", + "Google Workspace" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1567/004", + "https://blog.talosintelligence.com/collab-app-abuse/", + "https://github.com/pushsecurity/saas-attacks/blob/main/techniques/webhooks/description.md", + "https://medium.com/checkmarx-security/webhook-party-malicious-packages-caught-exfiltrating-data-via-legit-webhook-services-6e046b07d191", + "https://support.discord.com/hc/en-us/articles/228383668-Intro-to-Webhooks", + "https://www.cyberark.com/resources/threat-research-blog/the-not-so-secret-war-on-discord", + "https://www.microsoft.com/security/blog/2023/10/03/defending-new-vectors-threat-actors-attempt-sql-server-to-cloud-lateral-movement/", + "https://www.redhat.com/en/topics/automation/what-is-a-webhook" + ] + }, + "related": [ + { + "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", + "type": "subtechnique-of" + } + ], + "uuid": "43f2776f-b4bd-4118-94b8-fee47e69676d", + "value": "Exfiltration Over Webhook - T1567.004" + }, { "description": "Adversaries may use email rules to hide inbound emails in a compromised user's mailbox. Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails. Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets on Windows systems.(Citation: Microsoft Inbox Rules)(Citation: MacOS Email Rules)(Citation: Microsoft New-InboxRule)(Citation: Microsoft Set-InboxRule)\n\nAdversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders. Adversaries may do this to hide security alerts, C2 communication, or responses to [Internal Spearphishing](https://attack.mitre.org/techniques/T1534) emails sent from the compromised account.\n\nAny user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails. These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender. Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines. (Citation: Microsoft Cloud App Security)\n\nIn some environments, administrators may be able to enable email rules that operate organization-wide rather than on individual inboxes. For example, Microsoft Exchange supports transport rules that evaluate all mail an organization receives against user-specified conditions, then performs a user-specified action on mail that adheres to those conditions.(Citation: Microsoft Mail Flow Rules 2023) Adversaries that abuse such features may be able to automatically modify or delete all emails related to specific topics (such as internal security incident notifications).", "meta": { @@ -11679,7 +12109,39 @@ "value": "Spoof Security Alerting - T1562.011" }, { - "description": "Adversaries may modify XDG autostart entries to execute programs or commands during system boot. Linux desktop environments that are XDG compliant implement functionality for XDG autostart entries. These entries will allow an application to automatically start during the startup of a desktop environment after user logon. By default, XDG autostart entries are stored within the /etc/xdg/autostart or ~/.config/autostart directories and have a .desktop file extension.(Citation: Free Desktop Application Autostart Feb 2006)\n\nWithin an XDG autostart entry file, the Type key specifies if the entry is an application (type 1), link (type 2) or directory (type 3). The Name key indicates an arbitrary name assigned by the creator and the Exec key indicates the application and command line arguments to execute.(Citation: Free Desktop Entry Keys)\n\nAdversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment. Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user. Adversaries may also use [Masquerading](https://attack.mitre.org/techniques/T1036) to make XDG autostart entries look as if they are associated with legitimate programs.", + "description": "Adversaries may evade defensive mechanisms by executing commands that hide from process interrupt signals. Many operating systems use signals to deliver messages to control process behavior. Command interpreters often include specific commands/flags that ignore errors and other hangups, such as when the user of the active session logs off.(Citation: Linux Signal Man) These interrupt signals may also be used by defensive tools and/or analysts to pause or terminate specified running processes. \n\nAdversaries may invoke processes using `nohup`, [PowerShell](https://attack.mitre.org/techniques/T1059/001) `-ErrorAction SilentlyContinue`, or similar commands that may be immune to hangups.(Citation: nohup Linux Man)(Citation: Microsoft PowerShell SilentlyContinue) This may enable malicious commands and malware to continue execution through system events that would otherwise terminate its execution, such as users logging off or the termination of its C2 network connection.\n\nHiding from process interrupt signals may allow malware to continue execution, but unlike [Trap](https://attack.mitre.org/techniques/T1546/005) this does not establish [Persistence](https://attack.mitre.org/tactics/TA0003) since the process will not be re-invoked once actually terminated.", + "meta": { + "external_id": "T1564.011", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Command: Command Execution", + "Process: Process Creation" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1564/011", + "https://learn.microsoft.com/powershell/module/microsoft.powershell.core/about/about_preference_variables?view=powershell-7.3#debugpreference", + "https://linux.die.net/man/1/nohup", + "https://man7.org/linux/man-pages/man7/signal.7.html" + ] + }, + "related": [ + { + "dest-uuid": "22905430-4901-4c2a-84f6-98243cb173f8", + "type": "subtechnique-of" + } + ], + "uuid": "4a2975db-414e-4c0c-bd92-775987514b4b", + "value": "Ignore Process Interrupts - T1564.011" + }, + { + "description": "Adversaries may add or modify XDG Autostart Entries to execute malicious programs or commands when a user’s desktop environment is loaded at login. XDG Autostart entries are available for any XDG-compliant Linux system. XDG Autostart entries use Desktop Entry files (`.desktop`) to configure the user’s desktop environment upon user login. These configuration files determine what applications launch upon user login, define associated applications to open specific file types, and define applications used to open removable media.(Citation: Free Desktop Application Autostart Feb 2006)(Citation: Free Desktop Entry Keys)\n\nAdversaries may abuse this feature to establish persistence by adding a path to a malicious binary or command to the `Exec` directive in the `.desktop` configuration file. When the user’s desktop environment is loaded at user login, the `.desktop` files located in the XDG Autostart directories are automatically executed. System-wide Autostart entries are located in the `/etc/xdg/autostart` directory while the user entries are located in the `~/.config/autostart` directory.\n\nAdversaries may combine this technique with [Masquerading](https://attack.mitre.org/techniques/T1036) to blend malicious Autostart entries with legitimate programs.(Citation: Red Canary Netwire Linux 2022)", "meta": { "external_id": "T1547.013", "kill_chain": [ @@ -11697,6 +12159,7 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1547/013", + "https://redcanary.com/blog/netwire-remote-access-trojan-on-linux/", "https://specifications.freedesktop.org/autostart-spec/autostart-spec-latest.html", "https://specifications.freedesktop.org/desktop-entry-spec/1.2/ar01s06.html" ] @@ -12089,7 +12552,7 @@ "value": "Compile After Delivery - T1500" }, { - "description": "Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)\n\nUtilities, such as NinjaCopy, exist to perform these actions in PowerShell. (Citation: Github PowerSploit Ninjacopy)", + "description": "Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools. (Citation: Hakobyan 2009)\n\nUtilities, such as `NinjaCopy`, exist to perform these actions in PowerShell.(Citation: Github PowerSploit Ninjacopy) Adversaries may also use built-in or third-party utilities (such as `vssadmin`, `wbadmin`, and [esentutl](https://attack.mitre.org/software/S0404)) to create shadow copies or backups of data from system volumes.(Citation: LOLBAS Esentutl)", "meta": { "external_id": "T1006", "kill_chain": [ @@ -12097,7 +12560,8 @@ ], "mitre_data_sources": [ "Command: Command Execution", - "Drive: Drive Access" + "Drive: Drive Access", + "File: File Creation" ], "mitre_platforms": [ "Windows" @@ -12105,7 +12569,8 @@ "refs": [ "http://www.codeproject.com/Articles/32169/FDump-Dumping-File-Sectors-Directly-from-Disk-usin", "https://attack.mitre.org/techniques/T1006", - "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1" + "https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Invoke-NinjaCopy.ps1", + "https://lolbas-project.github.io/lolbas/Binaries/Esentutl/" ] }, "uuid": "0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", @@ -12356,13 +12821,14 @@ "value": "Device Administrator Permissions - T1401" }, { - "description": "Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). \n\nFiles can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016)\n\nOn Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)", + "description": "Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as [ftp](https://attack.mitre.org/software/S0095). Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. [Lateral Tool Transfer](https://attack.mitre.org/techniques/T1570)). \n\nOn Windows, adversaries may use various utilities to download tools, such as `copy`, `finger`, [certutil](https://attack.mitre.org/software/S0160), and [PowerShell](https://attack.mitre.org/techniques/T1059/001) commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest. On Linux and macOS systems, a variety of utilities also exist, such as `curl`, `scp`, `sftp`, `tftp`, `rsync`, `finger`, and `wget`.(Citation: t1105_lolbas)\n\nAdversaries may also abuse installers and package managers, such as `yum` or `winget`, to download tools to victim hosts.\n\nFiles can also be transferred using various [Web Service](https://attack.mitre.org/techniques/T1102)s as well as native or otherwise present tools on the victim system.(Citation: PTSecurity Cobalt Dec 2016) In some cases, adversaries may be able to leverage services that sync between a web-based and an on-premises client, such as Dropbox or OneDrive, to transfer files onto victim systems. For example, by compromising a cloud account and logging into the service's web portal, an adversary may be able to trigger an automatic syncing process that transfers the file onto the victim's machine.(Citation: Dropbox Malware Sync)", "meta": { "external_id": "T1105", "kill_chain": [ "mitre-attack:command-and-control" ], "mitre_data_sources": [ + "Command: Command Execution", "File: File Creation", "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Content", @@ -12377,7 +12843,8 @@ "https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf", "https://attack.mitre.org/techniques/T1105", "https://lolbas-project.github.io/#t1105", - "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf" + "https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf", + "https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/" ] }, "uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", @@ -12793,7 +13260,7 @@ "value": "Rogue Domain Controller - T1207" }, { - "description": "Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, HBSS, Altiris, etc.).\n\nAccess to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.\n\nThe permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform it's intended purpose.", + "description": "Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, HBSS, Altiris, etc.). \n\nAccess to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints. Network infrastructure may also have administration tools that can be similarly abused by adversaries. (Citation: Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation)\n\nThe permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require an administrative account to log in or to perform it's intended purpose.", "meta": { "external_id": "T1072", "kill_chain": [ @@ -12807,10 +13274,12 @@ "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "Network" ], "refs": [ - "https://attack.mitre.org/techniques/T1072" + "https://attack.mitre.org/techniques/T1072", + "https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem" ] }, "uuid": "92a78814-b191-47ca-909c-1ccfe3777414", @@ -13052,7 +13521,8 @@ "mitre_data_sources": [ "Command: Command Execution", "Network Traffic: Network Connection Creation", - "Process: Process Creation" + "Process: Process Creation", + "WMI: WMI Creation" ], "mitre_platforms": [ "Windows" @@ -13108,7 +13578,8 @@ "macOS", "Linux", "Network", - "IaaS" + "IaaS", + "Containers" ], "refs": [ "https://attack.mitre.org/techniques/T1490", @@ -13293,7 +13764,7 @@ "value": "Pass the Hash - T1075" }, { - "description": "Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e. [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation. Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019)\n\nFiles can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095).", + "description": "Adversaries may transfer tools or other files between systems in a compromised environment. Once brought into the victim environment (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.\n\nAdversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) to connected network shares or with authenticated connections via [Remote Desktop Protocol](https://attack.mitre.org/techniques/T1021/001).(Citation: Unit42 LockerGoga 2019)\n\nFiles can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and [ftp](https://attack.mitre.org/software/S0095). In some cases, adversaries may be able to leverage [Web Service](https://attack.mitre.org/techniques/T1102)s such as Dropbox or OneDrive to copy files from one machine to another via shared, automatically synced folders.(Citation: Dropbox Malware Sync)", "meta": { "external_id": "T1570", "kill_chain": [ @@ -13316,7 +13787,8 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1570", - "https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/" + "https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/", + "https://www.technologyreview.com/2013/08/21/83143/dropbox-and-similar-services-can-sync-malware/" ] }, "uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", @@ -13385,7 +13857,7 @@ "value": "Cloud Infrastructure Discovery - T1580" }, { - "description": "Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.\n\nAdversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users. The generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials.(Citation: AWS Temporary Security Credentials)\n\nOnce forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance) ", + "description": "Adversaries may forge credential materials that can be used to gain access to web applications or Internet services. Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.\n\nAdversaries may generate these credential materials in order to gain access to web resources. This differs from [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539), [Steal Application Access Token](https://attack.mitre.org/techniques/T1528), and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.\n\nThe generation of web credentials often requires secret values, such as passwords, [Private Keys](https://attack.mitre.org/techniques/T1552/004), or other cryptographic seed values.(Citation: GitHub AWS-ADFS-Credential-Generator) Adversaries may also forge tokens by taking advantage of features such as the `AssumeRole` and `GetFederationToken` APIs in AWS, which allow users to request temporary security credentials (i.e., [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005)), or the `zmprov gdpak` command in Zimbra, which generates a pre-authentication key that can be used to generate tokens for any user in the domain.(Citation: AWS Temporary Security Credentials)(Citation: Zimbra Preauth)\n\nOnce forged, adversaries may use these web credentials to access resources (ex: [Use Alternate Authentication Material](https://attack.mitre.org/techniques/T1550)), which may bypass multi-factor and other authentication protection mechanisms.(Citation: Pass The Cookie)(Citation: Unit 42 Mac Crypto Cookies January 2019)(Citation: Microsoft SolarWinds Customer Guidance) ", "meta": { "external_id": "T1606", "kill_chain": [ @@ -13412,6 +13884,7 @@ "https://github.com/damianh/aws-adfs-credential-generator", "https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/", "https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/", + "https://wiki.zimbra.com/wiki/Preauth", "https://wunderwuzzi23.github.io/blog/passthecookie.html" ] }, @@ -13871,7 +14344,7 @@ "value": "Netsh Helper DLL - T1128" }, { - "description": "An adversary may use legitimate desktop support and remote access software, such as Team Viewer, AnyDesk, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.(Citation: Symantec Living off the Land)\n\nRemote access tools may be installed and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system. Installation of many remote access tools may also include persistence (ex: the tool's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)).\n\nAdmin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns.(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)", + "description": "An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy)\n\nRemote access software may be installed and used post-compromise as an alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system. They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.\n \nAdversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.\n\nInstallation of many remote access software may also include persistence (e.g., the software's installation routine creates a [Windows Service](https://attack.mitre.org/techniques/T1543/003)).", "meta": { "external_id": "T1219", "kill_chain": [ @@ -14917,7 +15390,15 @@ "https://attack.mitre.org/techniques/T1442" ] }, - "related": [], + "related": [ + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "e30cc912-7ea1-4683-9219-543b86cbdec9", "value": "Fake Developer Accounts - T1442" }, @@ -15117,7 +15598,7 @@ "value": "Implant Internal Image - T1525" }, { - "description": "An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.\n\nAdversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)\n\nFor example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)\n\nAdversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) or [Disable Cloud Logs](https://attack.mitre.org/techniques/T1562/008).", + "description": "An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.\n\nAdversaries may attempt to discover information about the services enabled throughout the environment. Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.(Citation: Azure - Resource Manager API)(Citation: Azure AD Graph API)\n\nFor example, Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.(Citation: Azure - Stormspotter)(Citation: GitHub Pacu)\n\nAdversaries may use the information gained to shape follow-on behaviors, such as targeting data or credentials from enumerated services or evading identified defenses through [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001) or [Disable or Modify Cloud Logs](https://attack.mitre.org/techniques/T1562/008).", "meta": { "external_id": "T1526", "kill_chain": [ @@ -15437,7 +15918,15 @@ "https://attack.mitre.org/techniques/T1443" ] }, - "related": [], + "related": [ + { + "dest-uuid": "d9db3d46-66ca-44b4-9daa-1ef97cb7465a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "831e3269-da49-48ac-94dc-948008e8fd16", "value": "Remotely Install Application - T1443" }, @@ -15741,6 +16230,24 @@ "uuid": "e49920b0-6c54-40c1-9571-73723653205f", "value": "Cloud Service Dashboard - T1538" }, + { + "description": "Adversaries may use legitimate remote access software, such as `VNC`, `TeamViewer`, `AirDroid`, `AirMirror`, etc., to establish an interactive command and control channel to target mobile devices. \n\nRemote access applications may be installed and used post-compromise as an alternate communication channel for redundant access or as a way to establish an interactive remote session with the target device. They may also be used as a component of malware to establish a reverse connection to an adversary-controlled system or service. Installation of remote access tools may also include persistence. ", + "meta": { + "external_id": "T1663", + "kill_chain": [ + "mitre-mobile-attack:command-and-control" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1663" + ] + }, + "uuid": "0b761f2b-197a-40f2-b100-8152cb957c0c", + "value": "Remote Access Software - T1663" + }, { "description": "Adversaries may utilize standard operating system APIs to collect data from permission-backed data stores on a device, such as the calendar or contact list. These permissions need to be declared ahead of time. On Android, they must be included in the application’s manifest. On iOS, they must be included in the application’s `Info.plist` file. \n\n \n\nIn almost all cases, the user is required to grant access to the data store that the application is trying to access. In recent OS versions, vendors have introduced additional privacy controls for users, such as the ability to grant permission to an application only while the application is being actively used by the user. \n\n \n\nIf the device has been jailbroken or rooted, an adversary may be able to access [Protected User Data](https://attack.mitre.org/techniques/T1636) without the user’s knowledge or approval. ", "meta": { @@ -15995,7 +16502,15 @@ "https://attack.mitre.org/techniques/T1455" ] }, - "related": [], + "related": [ + { + "dest-uuid": "2d646840-f6f5-4619-a5a8-29c8316bbac5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "c91c304a-975d-4501-9789-0db1c57afd3f", "value": "Exploit Baseband Vulnerability - T1455" }, @@ -16503,6 +17018,41 @@ "uuid": "9c99724c-a483-4d60-ad9d-7f004e42e8e8", "value": "One-Way Communication - T1102.003" }, + { + "description": "Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems. Adversaries may use Wi-Fi information as part of [Account Discovery](https://attack.mitre.org/techniques/T1087), [Remote System Discovery](https://attack.mitre.org/techniques/T1018), and other discovery or [Credential Access](https://attack.mitre.org/tactics/TA0006) activity to support both ongoing and future campaigns.\n\nAdversaries may collect various types of information about Wi-Fi networks from hosts. For example, on Windows names and passwords of all Wi-Fi networks a device has previously connected to may be available through `netsh wlan show profiles` to enumerate Wi-Fi names and then `netsh wlan show profile “Wi-Fi name” key=clear` to show a Wi-Fi network’s corresponding password.(Citation: BleepingComputer Agent Tesla steal wifi passwords)(Citation: Malware Bytes New AgentTesla variant steals WiFi credentials)(Citation: Check Point APT35 CharmPower January 2022) Additionally, names and other details of locally reachable Wi-Fi networks can be discovered using calls to `wlanAPI.dll` [Native API](https://attack.mitre.org/techniques/T1106) functions.(Citation: Binary Defense Emotes Wi-Fi Spreader)\n\nOn Linux, names and passwords of all Wi-Fi-networks a device has previously connected to may be available in files under ` /etc/NetworkManager/system-connections/`.(Citation: Wi-Fi Password of All Connected Networks in Windows/Linux) On macOS, the password of a known Wi-Fi may be identified with ` security find-generic-password -wa wifiname` (requires admin username/password).(Citation: Find Wi-Fi Password on Mac)\n", + "meta": { + "external_id": "T1016.002", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Command: Command Execution", + "Process: OS API Execution" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1016/002", + "https://mackeeper.com/blog/find-wi-fi-password-on-mac/", + "https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/", + "https://www.binarydefense.com/resources/blog/emotet-evolves-with-new-wi-fi-spreader/", + "https://www.bleepingcomputer.com/news/security/hackers-steal-wifi-passwords-using-upgraded-agent-tesla-malware/", + "https://www.geeksforgeeks.org/wi-fi-password-connected-networks-windowslinux/", + "https://www.malwarebytes.com/blog/news/2020/04/new-agenttesla-variant-steals-wifi-credentials" + ] + }, + "related": [ + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "type": "subtechnique-of" + } + ], + "uuid": "494ab9f0-36e0-4b06-b10d-57285b040a06", + "value": "Wi-Fi Discovery - T1016.002" + }, { "description": "Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing. Endpoint systems may be compromised through browsing to adversary controlled sites, as in [Drive-by Compromise](https://attack.mitre.org/techniques/T1189). In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001). Prior to [Drive-by Compromise](https://attack.mitre.org/techniques/T1189), adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site. Drive-by content can be staged on adversary controlled infrastructure that has been acquired ([Acquire Infrastructure](https://attack.mitre.org/techniques/T1583)) or previously compromised ([Compromise Infrastructure](https://attack.mitre.org/techniques/T1584)).\n\nAdversaries may upload or inject malicious web content, such as [JavaScript](https://attack.mitre.org/techniques/T1059/007), into websites.(Citation: FireEye CFR Watering Hole 2012)(Citation: Gallagher 2015) This may be done in a number of ways, including:\n\n* Inserting malicious scripts into web pages or other user controllable web content such as forum posts\n* Modifying script files served to websites from publicly writeable cloud storage buckets\n* Crafting malicious web advertisements and purchasing ad space on a website through legitimate ad providers (i.e., [Malvertising](https://attack.mitre.org/techniques/T1583/008))\n\nIn addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in [Gather Victim Host Information](https://attack.mitre.org/techniques/T1592)) to ensure it is vulnerable prior to attempting exploitation.(Citation: ATT ScanBox)\n\nWebsites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest. This kind of targeted campaign is referred to a strategic web compromise or watering hole attack.\n\nAdversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, etc.) during acquisition of infrastructure ([Domains](https://attack.mitre.org/techniques/T1583/001)) to help facilitate [Drive-by Compromise](https://attack.mitre.org/techniques/T1189).", "meta": { @@ -16853,7 +17403,7 @@ "value": "Command-Line Interface - T1605" }, { - "description": "Adversaries may generate network traffic using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.", + "description": "Adversaries may generate network traffic using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.", "meta": { "external_id": "T1509", "kill_chain": [ @@ -17218,9 +17768,11 @@ ], "mitre_data_sources": [ "Command: Command Execution", + "Logon Session: Logon Session Creation", "Process: OS API Execution", "Process: Process Access", - "Process: Process Creation" + "Process: Process Creation", + "Windows Registry: Windows Registry Key Modification" ], "mitre_platforms": [ "Windows" @@ -18691,7 +19243,9 @@ ], "mitre_data_sources": [ "Command: Command Execution", + "File: File Creation", "File: File Modification", + "Network Traffic: Network Traffic Flow", "Process: Process Creation", "Scheduled Job: Scheduled Job Creation", "Windows Registry: Windows Registry Key Creation" @@ -18703,7 +19257,7 @@ "https://attack.mitre.org/techniques/T1053/005", "https://blog.qualys.com/vulnerabilities-threat-research/2022/06/20/defending-against-scheduled-task-attacks-in-windows-environments", "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/audit-other-object-access-events", - "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_removal_sd_value_scheduled_task_hide.yml", + "https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_delete/registry_delete_schtasks_hide_task_via_sd_value_removal.yml", "https://social.technet.microsoft.com/Forums/en-US/e5bca729-52e7-4fcb-ba12-3225c564674c/scheduled-tasks-history-retention-settings?forum=winserver8gen", "https://technet.microsoft.com/en-us/sysinternals/bb963902", "https://technet.microsoft.com/library/dd315590.aspx", @@ -18760,7 +19314,7 @@ "value": "Web Shell - T1505.003" }, { - "description": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)\n\nEach .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. .service files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.\n\nAn adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.", + "description": "Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code. Systemd timers are unit files with file extension .timer that control services. Timers can be set to run on a calendar event or after a time span relative to a starting point. They can be used as an alternative to [Cron](https://attack.mitre.org/techniques/T1053/003) in Linux environments.(Citation: archlinux Systemd Timers Aug 2020) Systemd timers may be activated remotely via the systemctl command line utility, which operates over [SSH](https://attack.mitre.org/techniques/T1021/004).(Citation: Systemd Remote Control)\n\nEach .timer file must have a corresponding .service file with the same name, e.g., example.timer and example.service. .service files are [Systemd Service](https://attack.mitre.org/techniques/T1543/002) unit files that are managed by the systemd system and service manager.(Citation: Linux man-pages: systemd January 2014) Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.\n\nAn adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.(Citation: Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018)(Citation: gist Arch package compromise 10JUL2018)(Citation: acroread package compromised Arch Linux Mail 8JUL2018) Timers installed using privileged paths may be used to maintain root level persistence. Adversaries may also install user level timers to achieve user level persistence.(Citation: Falcon Sandbox smp: 28553b3a9d)", "meta": { "external_id": "T1053.006", "kill_chain": [ @@ -18784,6 +19338,7 @@ "https://lists.archlinux.org/pipermail/aur-general/2018-July/034153.html", "https://wiki.archlinux.org/index.php/Systemd/Timers", "https://www.bleepingcomputer.com/news/security/malware-found-in-arch-linux-aur-package-repository/", + "https://www.hybrid-analysis.com/sample/28553b3a9d2ad4361d33d29ac4bf771d008e0073cec01b5561c6348a608f8dd7?environmentId=300", "https://www.tecmint.com/control-systemd-services-on-remote-linux-server/" ] }, @@ -18921,7 +19476,8 @@ "Linux", "macOS", "Windows", - "Containers" + "Containers", + "Network" ], "refs": [ "https://attack.mitre.org/techniques/T1078/003" @@ -19029,7 +19585,7 @@ "value": "Unix Shell - T1059.004" }, { - "description": "Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. In some cases, cloud accounts may be federated with traditional identity management systems, such as Windows Active Directory.(Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\n\nCompromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases. Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a [Trusted Relationship](https://attack.mitre.org/techniques/T1199). Similar to [Domain Accounts](https://attack.mitre.org/techniques/T1078/002), compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.\n\nOnce a cloud account is compromised, an adversary may perform [Account Manipulation](https://attack.mitre.org/techniques/T1098) - for example, by adding [Additional Cloud Roles](https://attack.mitre.org/techniques/T1098/003) - to maintain persistence and potentially escalate their privileges.", + "description": "Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud or be hybrid joined between on-premises systems and the cloud through federation with other identity sources such as Windows Active Directory. (Citation: AWS Identity Federation)(Citation: Google Federating GC)(Citation: Microsoft Deploying AD Federation)\n\nService or user accounts may be targeted by adversaries through [Brute Force](https://attack.mitre.org/techniques/T1110), [Phishing](https://attack.mitre.org/techniques/T1566), or various other means to gain access to the environment. Federated accounts may be a pathway for the adversary to affect both on-premises systems and cloud environments.\n\nAn adversary may create long lasting [Additional Cloud Credentials](https://attack.mitre.org/techniques/T1098/001) on a compromised cloud account to maintain persistence in the environment. Such credentials may also be used to bypass security controls such as multi-factor authentication. \n\nCloud accounts may also be able to assume [Temporary Elevated Cloud Access](https://attack.mitre.org/techniques/T1548/005) or other privileges through various means within the environment. Misconfigurations in role assignments or role assumption policies may allow an adversary to use these mechanisms to leverage permissions outside the intended scope of the account. Such over privileged accounts may be used to harvest sensitive data from online storage accounts and databases through [Cloud API](https://attack.mitre.org/techniques/T1059/009) or other methods. \n", "meta": { "external_id": "T1078.004", "kill_chain": [ @@ -19233,7 +19789,8 @@ "meta": { "external_id": "T1098.005", "kill_chain": [ - "mitre-attack:persistence" + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "Active Directory: Active Directory Object Creation", @@ -19267,7 +19824,7 @@ "value": "Device Registration - T1098.005" }, { - "description": "Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: A), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). \n\nCloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.\n\nWith proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment. ", + "description": "Adversaries may abuse cloud APIs to execute malicious commands. APIs available in cloud environments provide various functionalities and are a feature-rich method for programmatic access to nearly all aspects of a tenant. These APIs may be utilized through various methods such as command line interpreters (CLIs), in-browser Cloud Shells, [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules like Azure for PowerShell(Citation: Microsoft - Azure PowerShell), or software developer kits (SDKs) available for languages such as [Python](https://attack.mitre.org/techniques/T1059/006). \n\nCloud API functionality may allow for administrative access across all major services in a tenant such as compute, storage, identity and access management (IAM), networking, and security policies.\n\nWith proper permissions (often via use of credentials such as [Application Access Token](https://attack.mitre.org/techniques/T1550/001) and [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004)), adversaries may abuse cloud APIs to invoke various functions that execute malicious actions. For example, CLI and PowerShell functionality may be accessed through binaries installed on cloud-hosted or on-premises hosts or accessed through a browser-based cloud shell offered by many cloud platforms (such as AWS, Azure, and GCP). These cloud shells are often a packaged unified environment to use CLI and/or scripting modules hosted as a container in the cloud environment. ", "meta": { "external_id": "T1059.009", "kill_chain": [ @@ -19413,7 +19970,7 @@ "value": "Fileless Storage - T1027.011" }, { - "description": "Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. With a sufficient level of access, the net user /add command can be used to create a local account. On macOS systems the dscl -create command can be used to create a local account. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username.(Citation: cisco_username_cmd)\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.", + "description": "Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. \n\nFor example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. On macOS systems the dscl -create command can be used to create a local account. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)\n\nSuch accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.", "meta": { "external_id": "T1136.001", "kill_chain": [ @@ -19428,11 +19985,13 @@ "Linux", "macOS", "Windows", - "Network" + "Network", + "Containers" ], "refs": [ "https://attack.mitre.org/techniques/T1136/001", "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720", + "https://kubernetes.io/docs/concepts/security/service-accounts/", "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-t2.html#wp1047035630" ] }, @@ -19788,6 +20347,7 @@ "mitre_data_sources": [ "Process: OS API Execution", "Process: Process Access", + "Process: Process Creation", "Process: Process Modification" ], "mitre_platforms": [ @@ -19811,7 +20371,7 @@ "value": "Process Hollowing - T1055.012" }, { - "description": "Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging. For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation: CrowdStrike BGH Ransomware 2021)(Citation: Mandiant BYOL 2018)(Citation: att_def_ps_logging)\n\nAdversaries may downgrade and use less-secure versions of various features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557).(Citation: Praetorian TLS Downgrade Attack 2014)", + "description": "Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls. Downgrade attacks typically take advantage of a system’s backward compatibility to force it into less secure modes of operation. \n\nAdversaries may downgrade and use various less-secure versions of features of a system, such as [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059)s or even network protocols that can be abused to enable [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557) or [Network Sniffing](https://attack.mitre.org/techniques/T1040).(Citation: Praetorian TLS Downgrade Attack 2014) For example, [PowerShell](https://attack.mitre.org/techniques/T1059/001) versions 5+ includes Script Block Logging (SBL) which can record executed script content. However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to [Impair Defenses](https://attack.mitre.org/techniques/T1562) while running malicious scripts that may have otherwise been detected.(Citation: CrowdStrike BGH Ransomware 2021)(Citation: Mandiant BYOL 2018)(Citation: att_def_ps_logging)\n\nAdversaries may similarly target network traffic to downgrade from an encrypted HTTPS connection to an unsecured HTTP connection that exposes network data in clear text.(Citation: Targeted SSL Stripping Attacks Are Real)(Citation: Crowdstrike Downgrade)", "meta": { "external_id": "T1562.010", "kill_chain": [ @@ -19829,9 +20389,11 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1562/010", + "https://blog.checkpoint.com/research/targeted-ssl-stripping-attacks-are-real/amp/", "https://nsfocusglobal.com/attack-and-defense-around-powershell-event-logging/", "https://powershellmagazine.com/2014/07/16/investigating-powershell-attacks/", "https://www.crowdstrike.com/blog/how-falcon-complete-stopped-a-big-game-hunting-ransomware-attack/", + "https://www.crowdstrike.com/cybersecurity-101/attack-types/downgrade-attacks/", "https://www.mandiant.com/resources/bring-your-own-land-novel-red-teaming-technique", "https://www.praetorian.com/blog/man-in-the-middle-tls-ssl-protocol-downgrade-attack/" ] @@ -20641,7 +21203,7 @@ "value": "Device Lockout - T1629.002" }, { - "description": "Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014) Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible. \n\nSystemd utilizes unit configuration files with the `.service` file extension to encode information about a service's process. By default, system level unit files are stored in the `/systemd/system` directory of the root owned directories (`/`). User level unit files are stored in the `/systemd/user` directories of the user owned directories (`$HOME`). (Citation: lambert systemd 2022) \n\nService unit files use the following directives to execute system commands:(Citation: freedesktop systemd.service) \n\n* `ExecStart`, `ExecStartPre`, and `ExecStartPost` directives cover execution of commands when a service is started manually by `systemctl`, or on system start if the service is set to automatically start.\n* `ExecReload` directive covers when a service restarts. \n* `ExecStop`, `ExecStopPre`, and `ExecStopPost` directives cover when a service is stopped. \n\nAdversaries may abuse systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files systemd uses upon reboot or starting a service.(Citation: Anomali Rocke March 2019) Adversaries may also place symbolic links in these directories, enabling systemd to find these payloads regardless of where they reside on the filesystem.\n\nThe `.service` file’s `User` directive can be used to run service as a specific user, which could result in privilege escalation based on specific user/group permissions.(Citation: Rapid7 Service Persistence 22JUNE2016) ", + "description": "Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence. Systemd is a system and service manager commonly used for managing background daemon processes (also known as services) and other system resources.(Citation: Linux man-pages: systemd January 2014) Systemd is the default initialization (init) system on many Linux distributions replacing legacy init systems, including SysVinit and Upstart, while remaining backwards compatible. \n\nSystemd utilizes unit configuration files with the `.service` file extension to encode information about a service's process. By default, system level unit files are stored in the `/systemd/system` directory of the root owned directories (`/`). User level unit files are stored in the `/systemd/user` directories of the user owned directories (`$HOME`).(Citation: lambert systemd 2022) \n\nInside the `.service` unit files, the following directives are used to execute commands:(Citation: freedesktop systemd.service) \n\n* `ExecStart`, `ExecStartPre`, and `ExecStartPost` directives execute when a service is started manually by `systemctl` or on system start if the service is set to automatically start.\n* `ExecReload` directive executes when a service restarts. \n* `ExecStop`, `ExecStopPre`, and `ExecStopPost` directives execute when a service is stopped. \n\nAdversaries have created new service files, altered the commands a `.service` file’s directive executes, and modified the user directive a `.service` file executes as, which could result in privilege escalation. Adversaries may also place symbolic links in these directories, enabling systemd to find these payloads regardless of where they reside on the filesystem.(Citation: Anomali Rocke March 2019)(Citation: airwalk backdoor unix systems)(Citation: Rapid7 Service Persistence 22JUNE2016) ", "meta": { "external_id": "T1543.002", "kill_chain": [ @@ -20661,6 +21223,7 @@ ], "refs": [ "http://man7.org/linux/man-pages/man1/systemd.1.html", + "http://www.ouah.org/backdoors.html", "https://attack.mitre.org/techniques/T1543/002", "https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/", "https://redcanary.com/blog/attck-t1501-understanding-systemd-service-persistence/", @@ -21326,7 +21889,7 @@ "value": "Indicator Blocking - T1562.006" }, { - "description": "Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place. Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\").(Citation: CISA IDN ST05-016)\n\nAdversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro Pawn Storm OAuth 2017) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishing 2021)", + "description": "Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this case, the malicious emails contain links. Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging [User Execution](https://attack.mitre.org/techniques/T1204). The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.\n\nAdversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly. Additionally, adversaries may use seemingly benign links that abuse special characters to mimic legitimate websites (known as an \"IDN homograph attack\").(Citation: CISA IDN ST05-016) URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023)\n\nAdversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to [Steal Application Access Token](https://attack.mitre.org/techniques/T1528)s.(Citation: Trend Micro Pawn Storm OAuth 2017) These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls. (Citation: Microsoft OAuth 2.0 Consent Phishing 2021)", "meta": { "external_id": "T1566.002", "kill_chain": [ @@ -21351,6 +21914,7 @@ "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide", "https://us-cert.cisa.gov/ncas/tips/ST05-016", "https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf", + "https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse", "https://www.microsoft.com/security/blog/2021/07/14/microsoft-delivers-comprehensive-solution-to-battle-rise-in-consent-phishing-emails/" ] }, @@ -21397,6 +21961,7 @@ ], "mitre_data_sources": [ "Command: Command Execution", + "Network Traffic: Network Traffic Flow", "Process: Process Creation", "Service: Service Creation", "Windows Registry: Windows Registry Key Modification" @@ -21493,6 +22058,8 @@ "mitre_data_sources": [ "Command: Command Execution", "Driver: Driver Load", + "File: File Metadata", + "Network Traffic: Network Traffic Flow", "Process: OS API Execution", "Process: Process Creation", "Service: Service Creation", @@ -21985,7 +22552,7 @@ "value": "Employee Names - T1589.003" }, { - "description": "Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site.\n\nAdversaries may also link to \"web bugs\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug)\n\nAdversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation: Mr. D0x BitB 2022)\n\nFrom the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.", + "description": "Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Establish Accounts](https://attack.mitre.org/techniques/T1585) or [Compromise Accounts](https://attack.mitre.org/techniques/T1586)) and/or sending multiple, seemingly urgent messages.\n\nAll forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.(Citation: TrendMictro Phishing)(Citation: PCMag FakeLogin) The given website may be a clone of a legitimate site (such as an online or corporate login portal) or may closely resemble a legitimate site in appearance and have a URL containing elements from the real site. URLs may also be obfuscated by taking advantage of quirks in the URL schema, such as the acceptance of integer- or hexadecimal-based hostname formats and the automatic discarding of text before an “@” symbol: for example, `hxxp://google.com@1157586937`.(Citation: Mandiant URL Obfuscation 2023)\n\nAdversaries may also link to \"web bugs\" or \"web beacons\" within phishing messages to verify the receipt of an email, while also potentially profiling and tracking victim information such as IP address.(Citation: NIST Web Bug)\n\nAdversaries may also be able to spoof a complete website using what is known as a \"browser-in-the-browser\" (BitB) attack. By generating a fake browser popup window with an HTML-based address bar that appears to contain a legitimate URL (such as an authentication portal), they may be able to prompt users to enter their credentials while bypassing typical URL verification methods.(Citation: ZScaler BitB 2020)(Citation: Mr. D0x BitB 2022)\n\nAdversaries can use phishing kits such as `EvilProxy` and `Evilginx2` to proxy the connection between the victim and the legitimate website. On a successful login, the victim is redirected to the legitimate website, while the adversary captures their session cookie (i.e., [Steal Web Session Cookie](https://attack.mitre.org/techniques/T1539)) in addition to their username and password. This may enable the adversary to then bypass MFA via [Web Session Cookie](https://attack.mitre.org/techniques/T1550/004).(Citation: Proofpoint Human Factor)\n\nFrom the fake website, information is gathered in web forms and sent to the adversary. Adversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to craft persuasive and believable lures.", "meta": { "external_id": "T1598.003", "kill_chain": [ @@ -22005,7 +22572,9 @@ "https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-spoofing-protection?view=o365-worldwide", "https://mrd0x.com/browser-in-the-browser-phishing-attack/", "https://www.cyber.gov.au/sites/default/files/2019-03/spoof_email_sender_policy_framework.pdf", + "https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse", "https://www.pcmag.com/news/hackers-try-to-phish-united-nations-staffers-with-fake-login-pages", + "https://www.proofpoint.com/sites/default/files/threat-reports/pfpt-us-tr-human-factor-report.pdf", "https://www.trendmicro.com/en_us/research/20/i/tricky-forms-of-phishing.html", "https://www.zscaler.com/blogs/security-research/fake-sites-stealing-steam-credentials" ] @@ -22090,6 +22659,41 @@ "uuid": "10ff21b9-5a01-4268-a1b5-3b55015f1847", "value": "LC_LOAD_DYLIB Addition - T1546.006" }, + { + "description": "Adversaries may use voice communications to ultimately gain access to victim systems. Spearphishing voice is a specific variant of spearphishing. It is different from other forms of spearphishing in that is employs the use of manipulating a user into providing access to systems through a phone call or other forms of voice communications. Spearphishing frequently involves social engineering techniques, such as posing as a trusted source (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.\n\nAll forms of phishing are electronically delivered social engineering. In this scenario, adversaries are not directly sending malware to a victim vice relying on [User Execution](https://attack.mitre.org/techniques/T1204) for delivery and execution. For example, victims may receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools ([Remote Access Software](https://attack.mitre.org/techniques/T1219)) onto their computer.(Citation: Unit42 Luna Moth)\n\nAdversaries may also combine voice phishing with [Multi-Factor Authentication Request Generation](https://attack.mitre.org/techniques/T1621) in order to trick users into divulging MFA credentials or accepting authentication prompts.(Citation: Proofpoint Vishing)", + "meta": { + "external_id": "T1566.004", + "kill_chain": [ + "mitre-attack:initial-access" + ], + "mitre_data_sources": [ + "Application Log: Application Log Content" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "Office 365", + "SaaS", + "Google Workspace" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1566/004", + "https://blog.sygnia.co/luna-moth-false-subscription-scams", + "https://unit42.paloaltonetworks.com/luna-moth-callback-phishing/", + "https://www.cisa.gov/uscert/ncas/alerts/aa23-025a", + "https://www.proofpoint.com/us/threat-reference/vishing" + ] + }, + "related": [ + { + "dest-uuid": "a62a8db3-f23a-4d8f-afd6-9dbc77e7813b", + "type": "subtechnique-of" + } + ], + "uuid": "bb5e59c4-abe7-40c7-8196-e373cb1e5974", + "value": "Spearphishing Voice - T1566.004" + }, { "description": "Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.(Citation: FireEye VBA stomp Feb 2020)\n\nMS Office documents with embedded VBA content store source code inside of module streams. Each module stream has a PerformanceCache that stores a separate compiled version of the VBA source code known as p-code. The p-code is executed when the MS Office version specified in the _VBA_PROJECT stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.(Citation: Evil Clippy May 2019)(Citation: Microsoft _VBA_PROJECT Stream)\n\nAn adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code. Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code. If the VBA source code is removed, some tools might even think that there are no macros present. If there is a version match between the _VBA_PROJECT stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.(Citation: Walmart Roberts Oct 2018)(Citation: FireEye VBA stomp Feb 2020)(Citation: pcodedmp Bontchev)", "meta": { @@ -22352,6 +22956,34 @@ "uuid": "19401639-28d0-4c3c-adcc-bc2ba22f6421", "value": "Digital Certificates - T1588.004" }, + { + "description": "Adversaries may use voice communications to elicit sensitive information that can be used during targeting. Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information. Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: [Impersonation](https://attack.mitre.org/techniques/T1656)) and/or creating a sense of urgency or alarm for the recipient.\n\nAll forms of phishing are electronically delivered social engineering. In this scenario, adversaries use phone calls to elicit sensitive information from victims. Known as voice phishing (or \"vishing\"), these communications can be manually executed by adversaries, hired call centers, or even automated via robocalls. Voice phishers may spoof their phone number while also posing as a trusted entity, such as a business partner or technical support staff.(Citation: BOA Telephone Scams)\n\nVictims may also receive phishing messages that direct them to call a phone number (\"callback phishing\") where the adversary attempts to collect confidential information.(Citation: Avertium callback phishing)\n\nAdversaries may also use information from previous reconnaissance efforts (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Victim-Owned Websites](https://attack.mitre.org/techniques/T1594)) to tailor pretexts to be even more persuasive and believable for the victim.", + "meta": { + "external_id": "T1598.004", + "kill_chain": [ + "mitre-attack:reconnaissance" + ], + "mitre_data_sources": [ + "Application Log: Application Log Content" + ], + "mitre_platforms": [ + "PRE" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1598/004", + "https://business.bofa.com/en-us/content/what-is-vishing.html", + "https://www.avertium.com/resources/threat-reports/everything-you-need-to-know-about-callback-phishing" + ] + }, + "related": [ + { + "dest-uuid": "cca0ccb6-a068-4574-a722-b1556f86833a", + "type": "subtechnique-of" + } + ], + "uuid": "6a5d222a-a7e0-4656-b110-782c33098289", + "value": "Spearphishing Voice - T1598.004" + }, { "description": "Adversaries may acquire user credentials from third-party password managers.(Citation: ise Password Manager February 2019) Password managers are applications designed to store user credentials, normally in an encrypted database. Credentials are typically accessible after a user provides a master password that unlocks the database. After the database is unlocked, these credentials may be copied to memory. These databases can be stored as files on disk.(Citation: ise Password Manager February 2019)\n\nAdversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.(Citation: FoxIT Wocao December 2019)(Citation: Github KeeThief) Adversaries may extract credentials from memory via [Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212).(Citation: NVD CVE-2019-3610)\n Adversaries may also try brute forcing via [Password Guessing](https://attack.mitre.org/techniques/T1110/001) to obtain the master password of a password manager.(Citation: Cyberreason Anchor December 2019)", "meta": { @@ -22552,7 +23184,7 @@ "value": "Plist Modification - T1547.011" }, { - "description": "Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, spoolsv.exe, during boot. \n\nAdversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\\SYSTEM\\\\[CurrentControlSet or ControlSet001]\\Control\\Print\\Environments\\\\[Windows architecture: e.g., Windows x64]\\Print Processors\\\\[user defined]\\Driver Registry key that points to the DLL. For the print processor to be correctly installed, it must be located in the system print-processor directory that can be found with the GetPrintProcessorDirectory API call.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020) The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.", + "description": "Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation. Print processors are DLLs that are loaded by the print spooler service, `spoolsv.exe`, during boot.(Citation: Microsoft Intro Print Processors)\n\nAdversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup. A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled. Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\\SYSTEM\\\\[CurrentControlSet or ControlSet001]\\Control\\Print\\Environments\\\\[Windows architecture: e.g., Windows x64]\\Print Processors\\\\[user defined]\\Driver Registry key that points to the DLL.\n\nFor the malicious print processor to be correctly installed, the payload must be located in the dedicated system print-processor directory, that can be found with the GetPrintProcessorDirectory API call, or referenced via a relative path from this directory.(Citation: Microsoft AddPrintProcessor May 2018) After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.(Citation: ESET PipeMon May 2020)\n\nThe print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.", "meta": { "external_id": "T1547.012", "kill_chain": [ @@ -22572,6 +23204,7 @@ "refs": [ "https://attack.mitre.org/techniques/T1547/012", "https://docs.microsoft.com/en-us/windows/win32/printdocs/addprintprocessor", + "https://learn.microsoft.com/windows-hardware/drivers/print/introduction-to-print-processors", "https://www.welivesecurity.com/2020/05/21/no-game-over-winnti-group/" ] }, @@ -23296,12 +23929,14 @@ "Network Share: Network Share Access", "Network Traffic: Network Connection Creation", "Network Traffic: Network Traffic Flow", - "Process: Process Creation" + "Process: Process Creation", + "WMI: WMI Creation" ], "mitre_platforms": [ "Linux", "macOS", - "Windows" + "Windows", + "IaaS" ], "refs": [ "http://lockboxx.blogspot.com/2019/07/macos-red-teaming-206-ard-apple-remote.html", @@ -23484,7 +24119,15 @@ "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/" ] }, - "related": [], + "related": [ + { + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "06780952-177c-4247-b978-79c357fb311f", "value": "Plist Modification - T1150" }, @@ -23542,7 +24185,7 @@ "value": "Shared Webroot - T1051" }, { - "description": "Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nNative API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system. While invoking API functions, adversaries may also attempt to bypass defensive tools (ex: unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001)).", + "description": "Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.(Citation: NT API Windows)(Citation: Linux Kernel API) These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.\n\nAdversaries may abuse these OS API functions as a means of executing behaviors. Similar to [Command and Scripting Interpreter](https://attack.mitre.org/techniques/T1059), the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.\n\nNative API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.(Citation: OutFlank System Calls)(Citation: CyberBit System Calls)(Citation: MDSec System Calls) For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.(Citation: Microsoft CreateProcess)(Citation: GNU Fork) This may allow API callers to execute a binary, run a CLI command, load modules, etc. as thousands of similar API functions exist for various system operations.(Citation: Microsoft Win32)(Citation: LIBC)(Citation: GLIBC)\n\nHigher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs. These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.(Citation: Microsoft NET)(Citation: Apple Core Services)(Citation: MACOS Cocoa)(Citation: macOS Foundation)\n\nAdversaries may use assembly to directly or in-directly invoke syscalls in an attempt to subvert defensive sensors and detection signatures such as user mode API-hooks.(Citation: Redops Syscalls) Adversaries may also attempt to tamper with sensors and defensive tools associated with API monitoring, such as unhooking monitored functions via [Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001).", "meta": { "external_id": "T1106", "kill_chain": [ @@ -23567,6 +24210,7 @@ "https://dotnet.microsoft.com/learn/dotnet/what-is-dotnet-framework", "https://man7.org/linux/man-pages//man7/libc.7.html", "https://outflank.nl/blog/2019/06/19/red-team-tactics-combining-direct-system-calls-and-srdi-to-bypass-av-edr/", + "https://redops.at/en/blog/direct-syscalls-vs-indirect-syscalls", "https://undocumented.ntinternals.net/", "https://www.cyberbit.com/blog/endpoint-security/malware-mitigation-when-direct-system-calls-are-used/", "https://www.gnu.org/software/libc/", @@ -24641,11 +25285,12 @@ "value": "Multilayer Encryption - T1079" }, { - "description": "Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).", + "description": "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).", "meta": { "external_id": "T1098", "kill_chain": [ - "mitre-attack:persistence" + "mitre-attack:persistence", + "mitre-attack:privilege-escalation" ], "mitre_data_sources": [ "Active Directory: Active Directory Object Modification", @@ -24664,7 +25309,8 @@ "macOS", "Google Workspace", "SaaS", - "Network" + "Network", + "Containers" ], "refs": [ "https://attack.mitre.org/techniques/T1098", @@ -24686,6 +25332,7 @@ ], "mitre_data_sources": [ "Command: Command Execution", + "Network Traffic: Network Traffic Flow", "Process: OS API Execution", "Process: Process Creation", "Windows Registry: Windows Registry Key Creation", @@ -25158,7 +25805,15 @@ "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" ] }, - "related": [], + "related": [ + { + "dest-uuid": "6747daa2-3533-4e78-8fb8-446ebb86448a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], "uuid": "36675cd3-fe00-454c-8516-aebecacbe9d9", "value": "Login Item - T1162" }, @@ -25254,7 +25909,7 @@ "value": "Spearphishing Link - T1192" }, { - "description": "Adversaries may execute malicious payloads via loading shared modules. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like CreateProcess, LoadLibrary, etc. of the Win32 API.(Citation: Wikipedia Windows Library Files)\n\nThe module loader can load DLLs:\n\n* via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;\n \n* via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);\n \n* via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;\n \n* via <file name=\"filename.extension\" loadFrom=\"fully-qualified or relative pathname\"> in an embedded or external \"application manifest\". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.\n\nAdversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, malware may execute share modules to load additional components or features.", + "description": "Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., [Native API](https://attack.mitre.org/techniques/T1106)).\n\nAdversaries may use this functionality as a way to execute arbitrary payloads on a victim system. For example, adversaries can modularize functionality of their malware into shared objects that perform various functions such as managing C2 network communications or execution of specific actions on objective.\n\nThe Linux & macOS module loader can load and execute shared objects from arbitrary local paths. This functionality resides in `dlfcn.h` in functions such as `dlopen` and `dlsym`. Although macOS can execute `.so` files, common practice uses `.dylib` files.(Citation: Apple Dev Dynamic Libraries)(Citation: Linux Shared Libraries)(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: Unit42 OceanLotus 2017)\n\nThe Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in `NTDLL.dll` and is part of the Windows [Native API](https://attack.mitre.org/techniques/T1106) which is called from functions like `LoadLibrary` at run time.(Citation: Microsoft DLL)", "meta": { "external_id": "T1129", "kill_chain": [ @@ -25265,11 +25920,17 @@ "Process: OS API Execution" ], "mitre_platforms": [ - "Windows" + "Windows", + "macOS", + "Linux" ], "refs": [ "https://attack.mitre.org/techniques/T1129", - "https://en.wikipedia.org/wiki/Microsoft_Windows_library_files" + "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/", + "https://developer.apple.com/library/archive/documentation/DeveloperTools/Conceptual/DynamicLibraries/100-Articles/OverviewOfDynamicLibraries.html", + "https://learn.microsoft.com/troubleshoot/windows-client/deployment/dynamic-link-library", + "https://tldp.org/HOWTO/Program-Library-HOWTO/shared-libraries.html", + "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/" ] }, "uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", @@ -25370,7 +26031,9 @@ "Linux", "macOS", "Google Workspace", - "Network" + "Network", + "Containers", + "SaaS" ], "refs": [ "https://attack.mitre.org/techniques/T1136", @@ -25608,7 +26271,7 @@ "value": "Private Keys - T1145" }, { - "description": "An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen. Several methods exist to accomplish this, including:\n\n* Biometric spoofing: If biometric authentication is used, an adversary could attempt to spoof a mobile device’s biometric authentication mechanism. Both iOS and Android partly mitigate this attack by requiring the device’s passcode rather than biometrics to unlock the device after every device restart, and after a set or random amount of time.(Citation: SRLabs-Fingerprint)(Citation: TheSun-FaceID)\n* Unlock code bypass: An adversaries could attempt to brute-force or otherwise guess the lockscreen passcode (typically a PIN or password), including physically observing (“shoulder surfing”) the device owner’s use of the lockscreen passcode. Mobile OS vendors partly mitigate this by implementing incremental backoff timers after a set number of failed unlock attempts, as well as a configurable full device wipe after several failed unlock attempts.\n* Vulnerability exploit: Techniques have been periodically demonstrated that exploit mobile devices to bypass the lockscreen. The vulnerabilities are generally patched by the device or OS vendor once disclosed.(Citation: Wired-AndroidBypass)(Citation: Kaspersky-iOSBypass)\n", + "description": "An adversary with physical access to a mobile device may seek to bypass the device’s lockscreen. Several methods exist to accomplish this, including:\n\n* Biometric spoofing: If biometric authentication is used, an adversary could attempt to spoof a mobile device’s biometric authentication mechanism. Both iOS and Android partly mitigate this attack by requiring the device’s passcode rather than biometrics to unlock the device after every device restart, and after a set or random amount of time.(Citation: SRLabs-Fingerprint)(Citation: TheSun-FaceID)\n* Unlock code bypass: An adversary could attempt to brute-force or otherwise guess the lockscreen passcode (typically a PIN or password), including physically observing (“shoulder surfing”) the device owner’s use of the lockscreen passcode. Mobile OS vendors partly mitigate this by implementing incremental backoff timers after a set number of failed unlock attempts, as well as a configurable full device wipe after several failed unlock attempts.\n* Vulnerability exploit: Techniques have been periodically demonstrated that exploit mobile devices to bypass the lockscreen. The vulnerabilities are generally patched by the device or OS vendor once disclosed.(Citation: Wired-AndroidBypass)(Citation: Kaspersky-iOSBypass)\n", "meta": { "external_id": "T1461", "kill_chain": [ @@ -26004,6 +26667,27 @@ "uuid": "dd901512-6e37-4155-943b-453e3777b125", "value": "Launch Agent - T1159" }, + { + "description": "An adversary may push an update to a previously benign application to add malicious code. This can be accomplished by pushing an initially benign, functional application to a trusted application store, such as the Google Play Store or the Apple App Store. This allows the adversary to establish a trusted userbase that may grant permissions to the application prior to the introduction of malicious code. Then, an application update could be pushed to introduce malicious code.(Citation: android_app_breaking_bad)\n\nThis technique could also be accomplished by compromising a developer’s account. This would allow an adversary to take advantage of an existing userbase without having to establish the userbase themselves. ", + "meta": { + "external_id": "T1661", + "kill_chain": [ + "mitre-mobile-attack:initial-access", + "mitre-mobile-attack:defense-evasion" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1661", + "https://pages.nist.gov/mobile-threat-catalogue/supply-chain-threats/SPC-20.html", + "https://www.welivesecurity.com/2023/05/23/android-app-breaking-bad-legitimate-screen-recording-file-exfiltration/" + ] + }, + "uuid": "28fdd23d-aee3-4afe-bc3f-5f1f52929258", + "value": "Application Versioning - T1661" + }, { "description": "Adversaries may make, forward, or block phone calls without user authorization. This could be used for adversary goals such as audio surveillance, blocking or forwarding calls from the device owner, or C2 communication.\n\nSeveral permissions may be used to programmatically control phone calls, including:\n\n* `ANSWER_PHONE_CALLS` - Allows the application to answer incoming phone calls(Citation: Android Permissions)\n* `CALL_PHONE` - Allows the application to initiate a phone call without going through the Dialer interface(Citation: Android Permissions)\n* `PROCESS_OUTGOING_CALLS` - Allows the application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether(Citation: Android Permissions)\n* `MANAGE_OWN_CALLS` - Allows a calling application which manages its own calls through the self-managed `ConnectionService` APIs(Citation: Android Permissions)\n* `BIND_TELECOM_CONNECTION_SERVICE` - Required permission when using a `ConnectionService`(Citation: Android Permissions)\n* `WRITE_CALL_LOG` - Allows an application to write to the device call log, potentially to hide malicious phone calls(Citation: Android Permissions)\n\nWhen granted some of these permissions, an application can make a phone call without opening the dialer first. However, if an application desires to simply redirect the user to the dialer with a phone number filled in, it can launch an Intent using `Intent.ACTION_DIAL`, which requires no specific permissions. This then requires the user to explicitly initiate the call or use some form of [Input Injection](https://attack.mitre.org/techniques/T1516) to programmatically initiate it.", "meta": { @@ -26425,9 +27109,13 @@ "Cloud Service: Cloud Service Modification", "Command: Command Execution", "Driver: Driver Load", + "File: File Deletion", + "File: File Modification", "Firewall: Firewall Disable", "Firewall: Firewall Rule Modification", + "Process: OS API Execution", "Process: Process Creation", + "Process: Process Modification", "Process: Process Termination", "Script: Script Execution", "Sensor Health: Host Status", @@ -26447,7 +27135,7 @@ ], "refs": [ "https://attack.mitre.org/techniques/T1562", - "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/#:~:text=Don’t%20Sleep%20has%20the%20capability%20to%20keep%20the%20computer%20from%20being%20shutdown%20and%20the%20user%20from%20being%20signed%20off.%20This%20was%20likely%20done%20to%20ensure%20nothing%20will%20interfere%20with%20the%20propagation%20of%20the%20ransomware%20payload" + "https://thedfirreport.com/2022/11/28/emotet-strikes-again-lnk-file-leads-to-domain-wide-ransomware/" ] }, "uuid": "3d333250-30e4-4a82-9edc-756c68afc529", @@ -26501,6 +27189,25 @@ "uuid": "b327a9c0-e709-495c-aa6e-00b042136e2b", "value": "SMS Control - T1582" }, + { + "description": "Adversaries may destroy data and files on specific devices or in large numbers to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives. \n\nTo achieve data destruction, adversaries may use the `pm uninstall` command to uninstall packages or the `rm` command to remove specific files. For example, adversaries may first use `pm uninstall` to uninstall non-system apps, and then use `rm (-f) ` to delete specific files, further hiding malicious activity.(Citation: rootnik_rooting_tool)(Citation: abuse_native_linux_tools)", + "meta": { + "external_id": "T1662", + "kill_chain": [ + "mitre-mobile-attack:impact" + ], + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1662", + "https://unit42.paloaltonetworks.com/rootnik-android-trojan-abuses-commercial-rooting-tool-and-steals-private-information/", + "https://www.trendmicro.com/en_za/research/22/i/how-malicious-actors-abuse-native-linux-tools-in-their-attacks.html" + ] + }, + "uuid": "9ef14445-6f35-4ed0-a042-5024f13a9242", + "value": "Data Destruction - T1662" + }, { "description": "Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target. Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign. Values an adversary can provide about a target system or environment to use as guardrails may include environment information such as location.(Citation: SWB Exodus March 2019)\n\nGuardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within. This use of guardrails is distinct from typical [System Checks](https://attack.mitre.org/techniques/T1633/001). While use of [System Checks](https://attack.mitre.org/techniques/T1633/001) may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.", "meta": { @@ -26650,6 +27357,37 @@ "uuid": "38a6d2f5-d948-4235-bb91-bb01604448b4", "value": "Credential pharming - T1374" }, + { + "description": "Adversaries may impair a system's ability to hibernate, reboot, or shut down in order to extend access to infected machines. When a computer enters a dormant state, some or all software and hardware may cease to operate which can disrupt malicious activity.(Citation: Sleep, shut down, hibernate)\n\nAdversaries may abuse system utilities and configuration settings to maintain access by preventing machines from entering a state, such as standby, that can terminate malicious activity.(Citation: Microsoft: Powercfg command-line options)(Citation: systemdsleep Linux)\n\nFor example, `powercfg` controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.(Citation: Two New Monero Malware Attacks Target Windows and Android Users) Adversaries may also extend system lock screen timeout settings.(Citation: BATLOADER: The Evasive Downloader Malware) Other relevant settings, such as disk and hibernate timeout, can be similarly abused to keep the infected machine running even if no user is active.(Citation: CoinLoader: A Sophisticated Malware Loader Campaign)\n\nAware that some malware cannot survive system reboots, adversaries may entirely delete files used to invoke system shut down or reboot.(Citation: Condi-Botnet-binaries)", + "meta": { + "external_id": "T1653", + "kill_chain": [ + "mitre-attack:persistence" + ], + "mitre_data_sources": [ + "Command: Command Execution", + "File: File Modification" + ], + "mitre_platforms": [ + "Windows", + "Linux", + "macOS", + "Network" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1653", + "https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html", + "https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/powercfg-command-line-options?adlt=strict", + "https://man7.org/linux/man-pages/man5/systemd-sleep.conf.5.html", + "https://securityintelligence.com/news/two-new-monero-malware-attacks-target-windows-and-android-users/", + "https://www.avg.com/en/signal/should-you-shut-down-sleep-or-hibernate-your-pc-or-mac-laptop", + "https://www.avira.com/en/blog/coinloader-a-sophisticated-malware-loader-campaign", + "https://www.fortinet.com/blog/threat-research/condi-ddos-botnet-spreads-via-tp-links-cve-2023-1389" + ] + }, + "uuid": "ea071aa0-8f17-416f-ab0d-2bab7e79003d", + "value": "Power Settings - T1653" + }, { "description": "Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.", "meta": { @@ -26676,7 +27414,7 @@ "value": "Encrypted Channel - T1573" }, { - "description": "Adversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.\n\nUse of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.", + "description": "Adversaries may buy, lease, or rent infrastructure that can be used during targeting. A wide variety of infrastructure exists for hosting and orchestrating adversary operations. Infrastructure solutions include physical or cloud servers, domains, and third-party web services.(Citation: TrendmicroHideoutsLease) Additionally, botnets are available for rent or purchase.\n\nUse of these infrastructure solutions allows adversaries to stage, launch, and execute operations. Solutions may help adversary operations blend in with traffic that is seen as normal, such as contacting third-party web services or acquiring infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090), including from residential proxy services.(Citation: amnesty_nso_pegasus)(Citation: FBI Proxies Credential Stuffing)(Citation: Mandiant APT29 Microsoft 365 2022) Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.", "meta": { "external_id": "T1583", "kill_chain": [ @@ -26698,6 +27436,8 @@ "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2", "https://threatconnect.com/blog/infrastructure-research-hunting/", "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/", + "https://www.ic3.gov/Media/News/2022/220818.pdf", + "https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft", "https://www.mandiant.com/resources/scandalous-external-detection-using-network-scan-data-and-automation" ] }, @@ -26794,7 +27534,35 @@ "value": "Hide Artifacts - T1564" }, { - "description": "Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\n\nUse of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090).(Citation: amnesty_nso_pegasus)\n\nBy using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)", + "description": "Adversaries may enumerate system and service logs to find useful data. These logs may highlight various types of valuable insights for an adversary, such as user authentication records ([Account Discovery](https://attack.mitre.org/techniques/T1087)), security or vulnerable software ([Software Discovery](https://attack.mitre.org/techniques/T1518)), or hosts within a compromised network ([Remote System Discovery](https://attack.mitre.org/techniques/T1018)).\n\nHost binaries may be leveraged to collect system logs. Examples include using `wevtutil.exe` or [PowerShell](https://attack.mitre.org/techniques/T1059/001) on Windows to access and/or export security event information.(Citation: WithSecure Lazarus-NoPineapple Threat Intel Report 2023)(Citation: Cadet Blizzard emerges as novel threat actor) In cloud environments, adversaries may leverage utilities such as the Azure VM Agent’s `CollectGuestLogs.exe` to collect security logs from cloud hosted infrastructure.(Citation: SIM Swapping and Abuse of the Microsoft Azure Serial Console)\n\nAdversaries may also target centralized logging infrastructure such as SIEMs. Logs may also be bulk exported and sent to adversary-controlled infrastructure for offline analysis.", + "meta": { + "external_id": "T1654", + "kill_chain": [ + "mitre-attack:discovery" + ], + "mitre_data_sources": [ + "Command: Command Execution", + "File: File Access", + "Process: Process Creation" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "IaaS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1654", + "https://labs.withsecure.com/content/dam/labs/docs/WithSecure-Lazarus-No-Pineapple-Threat-Intelligence-Report-2023.pdf", + "https://www.mandiant.com/resources/blog/sim-swapping-abuse-azure-serial", + "https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/" + ] + }, + "uuid": "866d0d6d-02c6-42bd-aa2f-02907fdc0969", + "value": "Log Enumeration - T1654" + }, + { + "description": "Adversaries may compromise third-party infrastructure that can be used during targeting. Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services. Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.(Citation: Mandiant APT1)(Citation: ICANNDomainNameHijacking)(Citation: Talos DNSpionage Nov 2018)(Citation: FireEye EPS Awakens Part 2) Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.\n\nUse of compromised infrastructure allows adversaries to stage, launch, and execute operations. Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites. For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with [Digital Certificates](https://attack.mitre.org/techniques/T1588/004)) to further blend in and support staged information gathering and/or [Phishing](https://attack.mitre.org/techniques/T1566) campaigns.(Citation: FireEye DNS Hijack 2019) Additionally, adversaries may also compromise infrastructure to support [Proxy](https://attack.mitre.org/techniques/T1090) and/or proxyware services.(Citation: amnesty_nso_pegasus)(Citation: Sysdig Proxyjacking)\n\nBy using compromised infrastructure, adversaries may make it difficult to tie their actions back to them. Prior to targeting, adversaries may compromise the infrastructure of other adversaries.(Citation: NSA NCSC Turla OilRig)", "meta": { "external_id": "T1584", "kill_chain": [ @@ -26815,6 +27583,7 @@ "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html", "https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf", "https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2", + "https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited/", "https://threatconnect.com/blog/infrastructure-research-hunting/", "https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html", "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/", @@ -26849,7 +27618,8 @@ "Windows", "IaaS", "Linux", - "macOS" + "macOS", + "Containers" ], "refs": [ "http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/", @@ -26923,7 +27693,7 @@ "value": "Serverless Execution - T1648" }, { - "description": "Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems, which may impact system and/or hosted service availability. \n\nOne common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs)\n\nAdditionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)\n\nAdversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR)", + "description": "Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. \n\nOne common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.(Citation: Kaspersky Lazarus Under The Hood Blog 2017) Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.(Citation: CloudSploit - Unused AWS Regions) Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro Exposed Docker APIs)\n\nAdditionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.(Citation: Trend Micro War of Crypto Miners)\n\nAdversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate [Network Denial of Service](https://attack.mitre.org/techniques/T1498) campaigns and/or to seed malicious torrents.(Citation: GoBotKR) Alternatively, they may engage in proxyjacking by selling use of the victims' network bandwidth and IP address to proxyware services.(Citation: Sysdig Proxyjacking)", "meta": { "external_id": "T1496", "kill_chain": [ @@ -26948,6 +27718,7 @@ "https://attack.mitre.org/techniques/T1496", "https://blog.cloudsploit.com/the-danger-of-unused-aws-regions-af0bf1b878fc", "https://securelist.com/lazarus-under-the-hood/77908/", + "https://sysdig.com/blog/proxyjacking-attackers-log4j-exploited/", "https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/", "https://www.trendmicro.com/en_us/research/19/e/infected-cryptocurrency-mining-containers-target-docker-hosts-with-exposed-apis-use-shodan-to-find-additional-victims.html", "https://www.trendmicro.com/en_us/research/20/i/war-of-linux-cryptocurrency-miners-a-battle-for-resources.html", @@ -27083,6 +27854,41 @@ "uuid": "67073dde-d720-45ae-83da-b12d5e73ca3b", "value": "Active Scanning - T1595" }, + { + "description": "Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware,(Citation: FBI-ransomware) business email compromise (BEC) and fraud,(Citation: FBI-BEC) \"pig butchering,\"(Citation: wired-pig butchering) bank hacking,(Citation: DOJ-DPRK Heist) and exploiting cryptocurrency networks.(Citation: BBC-Ronin) \n\nAdversaries may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) to conduct unauthorized transfers of funds.(Citation: Internet crime report 2022) In the case of business email compromise or email fraud, an adversary may utilize [Impersonation](https://attack.mitre.org/techniques/T1656) of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary.(Citation: FBI-BEC) This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.(Citation: VEC)\n\nExtortion by ransomware may occur, for example, when an adversary demands payment from a victim after [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) (Citation: NYT-Colonial) and [Exfiltration](https://attack.mitre.org/tactics/TA0010) of data, followed by threatening public exposure unless payment is made to the adversary.(Citation: Mandiant-leaks)\n\nDue to the potentially immense business impact of financial theft, an adversary may abuse the possibility of financial theft and seeking monetary gain to divert attention from their true goals such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and business disruption.(Citation: AP-NotPetya)", + "meta": { + "external_id": "T1657", + "kill_chain": [ + "mitre-attack:impact" + ], + "mitre_data_sources": [ + "Application Log: Application Log Content" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "Office 365", + "SaaS", + "Google Workspace" + ], + "refs": [ + "https://apnews.com/article/russia-ukraine-technology-business-europe-hacking-ce7a8aca506742ab8e8873e7f9f229c2", + "https://attack.mitre.org/techniques/T1657", + "https://www.bbc.com/news/technology-60933174", + "https://www.cisa.gov/sites/default/files/Ransomware_Trifold_e-version.pdf", + "https://www.cloudflare.com/learning/email-security/what-is-vendor-email-compromise/#:~:text=Vendor%20email%20compromise%2C%20also%20referred,steal%20from%20that%20vendor%27s%20customers.", + "https://www.fbi.gov/file-repository/fy-2022-fbi-congressional-report-business-email-compromise-and-real-estate-wire-fraud-111422.pdf/view", + "https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf", + "https://www.justice.gov/usao-cdca/pr/3-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyber-attacks-and", + "https://www.mandiant.com/resources/blog/ransomware-extortion-ot-docs", + "https://www.nytimes.com/2021/05/13/technology/colonial-pipeline-ransom.html", + "https://www.wired.com/story/pig-butchering-fbi-ic3-2022-report/" + ] + }, + "uuid": "851e071f-208d-4c79-adc6-5974c85c78f3", + "value": "Financial Theft - T1657" + }, { "description": "Adversaries may compromise accounts with services that can be used during targeting. For operations incorporating social engineering, the utilization of an online persona may be important. Rather than creating and cultivating accounts (i.e. [Establish Accounts](https://attack.mitre.org/techniques/T1585)), adversaries may compromise existing accounts. Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona. \n\nA variety of methods exist for compromising accounts, such as gathering credentials via [Phishing for Information](https://attack.mitre.org/techniques/T1598), purchasing credentials from third-party sites, brute forcing credentials (ex: password reuse from breach credential dumps), or paying employees, suppliers or business partners for access to credentials.(Citation: AnonHBGary)(Citation: Microsoft DEV-0537) Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.\n\nPersonas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, etc.). Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.\n\nAdversaries may directly leverage compromised email accounts for [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).", "meta": { @@ -27134,6 +27940,35 @@ "uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", "value": "Dynamic Resolution - T1568" }, + { + "description": "Adversaries may gain access and continuously communicate with victims by injecting malicious content into systems through online network traffic. Rather than luring victims to malicious payloads hosted on a compromised website (i.e., [Drive-by Target](https://attack.mitre.org/techniques/T1608/004) followed by [Drive-by Compromise](https://attack.mitre.org/techniques/T1189)), adversaries may initially access victims through compromised data-transfer channels where they can manipulate traffic and/or inject their own content. These compromised online network channels may also be used to deliver additional payloads (i.e., [Ingress Tool Transfer](https://attack.mitre.org/techniques/T1105)) and other data to already compromised systems.(Citation: ESET MoustachedBouncer)\n\nAdversaries may inject content to victim systems in various ways, including:\n\n* From the middle, where the adversary is in-between legitimate online client-server communications (**Note:** this is similar but distinct from [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557), which describes AiTM activity solely within an enterprise environment) (Citation: Kaspersky Encyclopedia MiTM)\n* From the side, where malicious content is injected and races to the client as a fake response to requests of a legitimate online server (Citation: Kaspersky ManOnTheSide)\n\nContent injection is often the result of compromised upstream communication channels, for example at the level of an internet service provider (ISP) as is the case with \"lawful interception.\"(Citation: Kaspersky ManOnTheSide)(Citation: ESET MoustachedBouncer)(Citation: EFF China GitHub Attack)", + "meta": { + "external_id": "T1659", + "kill_chain": [ + "mitre-attack:initial-access", + "mitre-attack:command-and-control" + ], + "mitre_data_sources": [ + "File: File Creation", + "Network Traffic: Network Traffic Content", + "Process: Process Creation" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1659", + "https://encyclopedia.kaspersky.com/glossary/man-in-the-middle-attack/", + "https://usa.kaspersky.com/blog/man-on-the-side/27854/", + "https://www.eff.org/deeplinks/2015/04/china-uses-unencrypted-websites-to-hijack-browsers-in-github-attack", + "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" + ] + }, + "uuid": "43c9bc06-715b-42db-972f-52d25c09a20c", + "value": "Content Injection - T1659" + }, { "description": "Adversaries may abuse system services or daemons to execute commands or programs. Adversaries can execute malicious content by interacting with or creating services either locally or remotely. Many services are set to run at boot, which can aid in achieving persistence ([Create or Modify System Process](https://attack.mitre.org/techniques/T1543)), but adversaries can also abuse services for one-time or temporary execution.", "meta": { @@ -27241,7 +28076,7 @@ "value": "Adversary-in-the-Middle - T1638" }, { - "description": "Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040) or [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)\n\nFor example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW) [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)\n\nAdversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498).", + "description": "Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.mitre.org/techniques/T1040), [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002), or replay attacks ([Exploitation for Credential Access](https://attack.mitre.org/techniques/T1212)). By abusing features of common networking protocols that can determine the flow of network traffic (e.g. ARP, DNS, LLMNR, etc.), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.(Citation: Rapid7 MiTM Basics)\n\nFor example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.(Citation: ttint_rat)(Citation: dns_changer_trojans)(Citation: ad_blocker_with_miner) Adversaries may also manipulate DNS and leverage their position in order to intercept user credentials and session cookies.(Citation: volexity_0day_sophos_FW) [Downgrade Attack](https://attack.mitre.org/techniques/T1562/010)s can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.(Citation: mitm_tls_downgrade_att)(Citation: taxonomy_downgrade_att_tls)(Citation: tlseminar_downgrade_att)\n\nAdversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in [Transmitted Data Manipulation](https://attack.mitre.org/techniques/T1565/002). Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to [Impair Defenses](https://attack.mitre.org/techniques/T1562) and/or in support of a [Network Denial of Service](https://attack.mitre.org/techniques/T1498).", "meta": { "external_id": "T1557", "kill_chain": [ @@ -27597,7 +28432,7 @@ "value": "DNS - T1071.004" }, { - "description": "Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured.\n\nKeylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include:\n\n* Hooking API callbacks used for processing keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data.\n* Reading raw keystroke data from the hardware buffer.\n* Windows Registry modifications.\n* Custom drivers.\n* [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks) ", + "description": "Adversaries may log user keystrokes to intercept credentials as the user types them. Keylogging is likely to be used to acquire credentials for new access opportunities when [OS Credential Dumping](https://attack.mitre.org/techniques/T1003) efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured. In order to increase the likelihood of capturing credentials quickly, an adversary may also perform actions such as clearing browser cookies to force users to reauthenticate to systems.(Citation: Talos Kimsuky Nov 2021)\n\nKeylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.(Citation: Adventures of a Keystroke) Some methods include:\n\n* Hooking API callbacks used for processing keystrokes. Unlike [Credential API Hooking](https://attack.mitre.org/techniques/T1056/004), this focuses solely on API functions intended for processing keystroke data.\n* Reading raw keystroke data from the hardware buffer.\n* Windows Registry modifications.\n* Custom drivers.\n* [Modify System Image](https://attack.mitre.org/techniques/T1601) may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.(Citation: Cisco Blog Legacy Device Attacks) ", "meta": { "external_id": "T1056.001", "kill_chain": [ @@ -27618,6 +28453,7 @@ "refs": [ "http://opensecuritytraining.info/Keylogging_files/The%20Adventures%20of%20a%20Keystroke.pdf", "https://attack.mitre.org/techniques/T1056/001", + "https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html", "https://community.cisco.com/t5/security-blogs/attackers-continue-to-target-legacy-devices/ba-p/4169954" ] }, @@ -27680,6 +28516,7 @@ "mitre_data_sources": [ "Command: Command Execution", "File: File Modification", + "Network Traffic: Network Traffic Flow", "Process: Process Creation", "Scheduled Job: Scheduled Job Creation" ], @@ -27848,7 +28685,12 @@ "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf" ] }, - "related": [], + "related": [ + { + "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", + "type": "subtechnique-of" + } + ], "uuid": "8faedf87-dceb-4c35-b2a2-7286f59a3bc3", "value": "Launchd - T1053.004" }, @@ -29670,7 +30512,7 @@ "value": "Kerberoasting - T1208" }, { - "description": "Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.\n\nRenaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site)", + "description": "Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.\n\nRenaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1036).(Citation: LOLBAS Main Site) Masquerading may also include the use of [Proxy](https://attack.mitre.org/techniques/T1090) or VPNs to disguise IP addresses, which can allow adversaries to blend in with normal network traffic and bypass conditional access policies or anti-abuse protections.", "meta": { "external_id": "T1036", "kill_chain": [ @@ -29681,6 +30523,8 @@ "File: File Metadata", "File: File Modification", "Image: Image Metadata", + "Process: OS API Execution", + "Process: Process Creation", "Process: Process Metadata", "Scheduled Job: Scheduled Job Metadata", "Scheduled Job: Scheduled Job Modification", @@ -29694,10 +30538,10 @@ "Containers" ], "refs": [ - "http://pages.endgame.com/rs/627-YBU-612/images/EndgameJournal_The%20Masquerade%20Ball_Pages_R2.pdf", "https://attack.mitre.org/techniques/T1036", "https://lolbas-project.github.io/", - "https://twitter.com/ItsReallyNick/status/1055321652777619457" + "https://twitter.com/ItsReallyNick/status/1055321652777619457", + "https://www.elastic.co/blog/how-hunt-masquerade-ball" ] }, "uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", @@ -29728,6 +30572,25 @@ "uuid": "7fd87010-3a00-4da3-b905-410525e8ec44", "value": "Scripting - T1064" }, + { + "description": "Adversaries may send malicious content to users in order to gain access to their mobile devices. All forms of phishing are electronically delivered social engineering. Adversaries can conduct both non-targeted phishing, such as in mass malware spam campaigns, as well as more targeted phishing tailored for a specific individual, company, or industry, known as “spearphishing”. Phishing often involves social engineering techniques, such as posing as a trusted source, as well as evasion techniques, such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages.\n\nMobile phishing may take various forms. For example, adversaries may send emails containing malicious attachments or links, typically to deliver and then execute malicious code on victim devices. Phishing may also be conducted via third-party services, like social media platforms. \n\nMobile devices are a particularly attractive target for adversaries executing phishing campaigns. Due to their smaller form factor than traditional desktop endpoints, users may not be able to notice minor differences between genuine and phishing websites. Further, mobile devices have additional sensors and radios that allow adversaries to execute phishing attempts over several different vectors, such as: \n\n- SMS messages: Adversaries may send SMS messages (known as “smishing”) from compromised devices to potential targets to convince the target to, for example, install malware, navigate to a specific website, or enable certain insecure configurations on their device.\n- Quick Response (QR) Codes: Adversaries may use QR codes (known as “quishing”) to redirect users to a phishing website. For example, an adversary could replace a legitimate public QR Code with one that leads to a different destination, such as a phishing website. A malicious QR code could also be delivered via other means, such as SMS or email. In the latter case, an adversary could utilize a malicious QR code in an email to pivot from the user’s desktop computer to their mobile device.\n- Phone Calls: Adversaries may call victims (known as “vishing”) to persuade them to perform an action, such as providing login credentials or navigating to a malicious website. This could also be used as a technique to perform the initial access on a mobile device, but then pivot to a computer/other network by having the victim perform an action on a desktop computer.\n", + "meta": { + "external_id": "T1660", + "kill_chain": [ + "mitre-mobile-attack:initial-access" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1660", + "https://pages.nist.gov/mobile-threat-catalogue/authentication-threats/AUT-9.html" + ] + }, + "uuid": "defc1257-4db1-4fb3-8ef5-bb77f63146df", + "value": "Phishing - T1660" + }, { "description": "A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR). (Citation: MTrends 2016)\n\nAdversaries may use bootkits to persist on systems at a layer below the operating system, which may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.\n\n### Master Boot Record\nThe MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS. It is the location of the boot loader. An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code. (Citation: Lau 2011)\n\n### Volume Boot Record\nThe MBR passes control of the boot process to the VBR. Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.", "meta": { @@ -30263,6 +31126,53 @@ "uuid": "7823039f-e2d5-4997-853c-ec983631206b", "value": "DNSCalc - T1324" }, + { + "description": "Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name, location, or appearance of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.\n\nRenaming abusable system utilities to evade security monitoring is also a form of [Masquerading](https://attack.mitre.org/techniques/T1655)\n", + "meta": { + "external_id": "T1655", + "kill_chain": [ + "mitre-mobile-attack:defense-evasion" + ], + "mitre_platforms": [ + "Android", + "iOS" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1655", + "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-14.html", + "https://pages.nist.gov/mobile-threat-catalogue/application-threats/APP-31.html" + ] + }, + "uuid": "f856eaab-e84a-4265-a8a2-7bf37e5dc2fc", + "value": "Masquerading - T1655" + }, + { + "description": "Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via [Phishing for Information](https://attack.mitre.org/techniques/T1598), [Phishing](https://attack.mitre.org/techniques/T1566), or [Internal Spearphishing](https://attack.mitre.org/techniques/T1534)) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims. \n \nIn many cases of business email compromise or email fraud campaigns, adversaries use impersonation to defraud victims -- deceiving them into sending money or divulging information that ultimately enables [Financial Theft](https://attack.mitre.org/techniques/T1657).\n\nAdversaries will often also use social engineering techniques such as manipulative and persuasive language in email subject lines and body text such as `payment`, `request`, or `urgent` to push the victim to act quickly before malicious activity is detected. These campaigns are often specifically targeted against people who, due to job roles and/or accesses, can carry out the adversary’s goal.   \n \nImpersonation is typically preceded by reconnaissance techniques such as [Gather Victim Identity Information](https://attack.mitre.org/techniques/T1589) and [Gather Victim Org Information](https://attack.mitre.org/techniques/T1591) as well as acquiring infrastructure such as email domains (i.e. [Domains](https://attack.mitre.org/techniques/T1583/001)) to substantiate their false identity.(Citation: CrowdStrike-BEC)\n \nThere is the potential for multiple victims in campaigns involving impersonation. For example, an adversary may [Compromise Accounts](https://attack.mitre.org/techniques/T1586) targeting one organization which can then be used to support impersonation against other entities.(Citation: VEC)", + "meta": { + "external_id": "T1656", + "kill_chain": [ + "mitre-attack:defense-evasion" + ], + "mitre_data_sources": [ + "Application Log: Application Log Content" + ], + "mitre_platforms": [ + "Linux", + "macOS", + "Windows", + "Office 365", + "SaaS", + "Google Workspace" + ], + "refs": [ + "https://attack.mitre.org/techniques/T1656", + "https://www.cloudflare.com/learning/email-security/what-is-vendor-email-compromise/#:~:text=Vendor%20email%20compromise%2C%20also%20referred,steal%20from%20that%20vendor%27s%20customers.", + "https://www.crowdstrike.com/cybersecurity-101/business-email-compromise-bec/" + ] + }, + "uuid": "c9e0c59e-162e-40a4-b8b1-78fab4329ada", + "value": "Impersonation - T1656" + }, { "description": "Adversaries may send phishing messages to gain access to victim systems. All forms of phishing are electronically delivered social engineering. Phishing can be targeted, known as spearphishing. In spearphishing, a specific individual, company, or industry will be targeted by the adversary. More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.\n\nAdversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems. Phishing may also be conducted via third-party services, like social media platforms. Phishing may also involve social engineering techniques, such as posing as a trusted source, as well as evasive techniques such as removing or manipulating emails or metadata/headers from compromised accounts being abused to send messages (e.g., [Email Hiding Rules](https://attack.mitre.org/techniques/T1564/008)).(Citation: Microsoft OAuth Spam 2022)(Citation: Palo Alto Unit 42 VBA Infostealer 2014) Another way to accomplish this is by forging or spoofing(Citation: Proofpoint-spoof) the identity of the sender which can be used to fool both the human recipient as well as automated security tools.(Citation: cyberproof-double-bounce) \n\nVictims may also receive phishing messages that instruct them to call a phone number where they are directed to visit a malicious URL, download malware,(Citation: sygnia Luna Month)(Citation: CISA Remote Monitoring and Management Software) or install adversary-accessible remote management tools onto their computer (i.e., [User Execution](https://attack.mitre.org/techniques/T1204)).(Citation: Unit42 Luna Moth)", "meta": { @@ -30330,5 +31240,5 @@ "value": "Keychain - T1579" } ], - "version": 25 + "version": 26 } diff --git a/clusters/mitre-course-of-action.json b/clusters/mitre-course-of-action.json index 9434f17..d5db3aa 100644 --- a/clusters/mitre-course-of-action.json +++ b/clusters/mitre-course-of-action.json @@ -153,6 +153,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "45241b9e-9bbc-4826-a2cc-78855e51ca09", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "457c7820-d331-465a-915e-42f85500ccc4", "tags": [ @@ -181,6 +188,20 @@ ], "type": "mitigates" }, + { + "dest-uuid": "51ea26b1-ff1e-4faa-b1a0-1114cd298c87", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "5b0ad6f8-6a16-4966-a4ef-d09ea6e2a9f5", "tags": [ @@ -1853,6 +1874,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", "tags": [ @@ -1993,6 +2021,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "887274fc-2d63-4bdc-82f3-fae56d1d5fdc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "8c32eb4d-805f-4fc5-bf60-c4d476c131b5", "tags": [ @@ -2227,6 +2262,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "28fdd23d-aee3-4afe-bc3f-5f1f52929258", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "3775a580-a1d1-46c4-8147-c614a715f2e9", "tags": [ @@ -2805,6 +2847,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "d4dc46e3-5ba5-45b9-8204-010867cacfcb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", "tags": [ @@ -3350,6 +3399,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "43c9bc06-715b-42db-972f-52d25c09a20c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "7385dfaf-6886-4229-9ecd-6fd678040830", "tags": [ @@ -3941,6 +3997,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "9c306d8d-cde7-4b4c-b6e8-d0bb16caca36", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "a0e6614a-7740-4b24-bd65-f1bde09fc365", "tags": [ @@ -4513,6 +4576,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "43c9bc06-715b-42db-972f-52d25c09a20c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "52759bf1-fe12-4052-ace6-c5b0cf7dd7fd", "tags": [ @@ -4863,6 +4933,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "106c0cf6-bf73-4601-9aa8-0945c2715ec5", "tags": [ @@ -4954,6 +5031,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "35d30338-5bfa-41b0-a170-ec06dfd75f64", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "35dd844a-b219-4e2b-a6bb-efa9a75995a9", "tags": [ @@ -4968,6 +5052,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "45241b9e-9bbc-4826-a2cc-78855e51ca09", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "4ab929c6-ee2d-4fb5-aab4-b14be2ed7179", "tags": [ @@ -5010,6 +5101,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "562e9b64-7239-493d-80f4-2bff900d9054", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "56e0d8b8-3e25-49dd-9050-3aa252f5aa92", "tags": [ @@ -5052,6 +5150,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "67720091-eee3-4d2d-ae16-8264567f6f5b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "677569f9-a8b0-459e-ab24-7f18091fa7bf", "tags": [ @@ -5073,6 +5178,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "6fa224c7-5091-4595-bf15-3fc9fe2f2c7c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "70857657-bd0b-4695-ad3e-b13f92cac1b4", "tags": [ @@ -5143,6 +5255,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "851e071f-208d-4c79-adc6-5974c85c78f3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "8565825b-21c8-4518-b75e-cbc4c717a156", "tags": [ @@ -5150,6 +5269,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "866d0d6d-02c6-42bd-aa2f-02907fdc0969", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", "tags": [ @@ -5297,6 +5423,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "ca00366b-83a1-4c7b-a0ce-8ff950a7c87f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "cacc40da-4c9e-462c-80d5-fd70a178b12d", "tags": [ @@ -5535,6 +5668,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "c9e0c59e-162e-40a4-b8b1-78fab4329ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "fe926152-f431-4baf-956c-4ad3cb0bf23b", "tags": [ @@ -6073,6 +6213,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", "tags": [ @@ -6416,6 +6563,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "cfb525cc-5494-401d-a82b-2539ca46a561", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "d0b4fcdb-d67d-4ed2-99ce-788b12f8c0f4", "tags": [ @@ -7090,6 +7244,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "92a78814-b191-47ca-909c-1ccfe3777414", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ @@ -7841,6 +8002,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "43f2776f-b4bd-4118-94b8-fee47e69676d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5", "tags": [ @@ -8586,6 +8754,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "35d30338-5bfa-41b0-a170-ec06dfd75f64", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "4ffc1794-ec3b-45be-9e52-42dbcb2af2de", "tags": [ @@ -8937,6 +9112,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "5abfc5e6-3c56-49e7-ad72-502d01acf28b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "667e5707-3843-4da8-bd34-88b922526f0d", "tags": [ @@ -9075,6 +9257,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "3257eb21-f9a7-4430-8de1-d8b6e288f529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "32ad5c86-2bcf-47d8-8fdc-d7f3d79a7490", "tags": [ @@ -9400,6 +9589,13 @@ ] }, "related": [ + { + "dest-uuid": "0b761f2b-197a-40f2-b100-8152cb957c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "0cdd66ad-26ac-4338-a764-4972a1e17ee3", "tags": [ @@ -9414,6 +9610,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e", "tags": [ @@ -9484,6 +9687,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "5abfc5e6-3c56-49e7-ad72-502d01acf28b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "648f8051-1a35-46d3-b1d8-3a3f5cf2cc8e", "tags": [ @@ -9547,6 +9757,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "9ef14445-6f35-4ed0-a042-5024f13a9242", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "a8c31121-852b-46bd-9ba4-674ae5afe7ad", "tags": [ @@ -9610,6 +9827,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "defc1257-4db1-4fb3-8ef5-bb77f63146df", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", "tags": [ @@ -9652,6 +9876,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "f856eaab-e84a-4265-a8a2-7bf37e5dc2fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "fcb11f06-ce0e-490b-bcc1-04a1623579f0", "tags": [ @@ -9672,6 +9903,13 @@ ] }, "related": [ + { + "dest-uuid": "0b761f2b-197a-40f2-b100-8152cb957c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "20b0931a-8952-42ca-975f-775bad295f1a", "tags": [ @@ -9686,6 +9924,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "28fdd23d-aee3-4afe-bc3f-5f1f52929258", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "39dd7871-f59b-495f-a9a5-3cb8cc50c9b2", "tags": [ @@ -9787,7 +10032,7 @@ "external_id": "M1014", "refs": [ "https://attack.mitre.org/mitigations/M1014", - "https://www.fcc.gov/files/csric5-wg10-finalreport031517pdf" + "https://web.archive.org/web/20200330012714/https://www.fcc.gov/files/csric5-wg10-finalreport031517pdf" ] }, "related": [ @@ -10216,6 +10461,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", "tags": [ @@ -10237,6 +10489,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "6a5d222a-a7e0-4656-b110-782c33098289", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "6add2ab5-2711-4e9d-87c8-7a0be8531530", "tags": [ @@ -10258,6 +10517,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "851e071f-208d-4c79-adc6-5974c85c78f3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "890c9858-598c-401d-a4d5-c67ebcdd703a", "tags": [ @@ -10328,6 +10594,20 @@ ], "type": "mitigates" }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, + { + "dest-uuid": "bb5e59c4-abe7-40c7-8196-e373cb1e5974", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", "tags": [ @@ -10335,6 +10615,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "c9e0c59e-162e-40a4-b8b1-78fab4329ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "cabe189c-a0e3-4965-a473-dcff00f17213", "tags": [ @@ -11454,6 +11741,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "3d333250-30e4-4a82-9edc-756c68afc529", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "52759bf1-fe12-4052-ace6-c5b0cf7dd7fd", "tags": [ @@ -11475,6 +11769,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "824add00-99a1-4b15-9a2d-6c5683b7b497", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "861b8fd2-57f3-4ee1-ab5d-c19c3b8c7a4a", "tags": [ @@ -12616,6 +12917,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "246fd3c7-f5e3-466d-8787-4c13d9e3b61c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", "tags": [ @@ -12637,6 +12945,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "887274fc-2d63-4bdc-82f3-fae56d1d5fdc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ @@ -12711,6 +13026,26 @@ "uuid": "a6a47a06-08fc-4ec4-bdc3-20373375ebb9", "value": "Antivirus/Antimalware - M1049" }, + { + "description": "Mobile security products, such as Mobile Threat Defense (MTD), offer various device-based mitigations against certain behaviors.", + "meta": { + "external_id": "M1058", + "refs": [ + "https://attack.mitre.org/mitigations/M1058" + ] + }, + "related": [ + { + "dest-uuid": "defc1257-4db1-4fb3-8ef5-bb77f63146df", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + } + ], + "uuid": "78671282-26aa-486c-a7a5-5921e1616b58", + "value": "Antivirus/Antimalware - M1058" + }, { "description": "Enable remote attestation capabilities when available (such as Android SafetyNet or Samsung Knox TIMA Attestation) and prohibit devices that fail the attestation from accessing enterprise resources.", "meta": { @@ -13055,6 +13390,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "562e9b64-7239-493d-80f4-2bff900d9054", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "56e0d8b8-3e25-49dd-9050-3aa252f5aa92", "tags": [ @@ -13279,6 +13621,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "ca00366b-83a1-4c7b-a0ce-8ff950a7c87f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "cc3502b5-30cc-4473-ad48-42d51a6ef6d1", "tags": [ @@ -13321,6 +13670,13 @@ ], "type": "mitigates" }, + { + "dest-uuid": "ea071aa0-8f17-416f-ab0d-2bab7e79003d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "mitigates" + }, { "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ @@ -13375,5 +13731,5 @@ "value": "Audit - M1047" } ], - "version": 26 + "version": 27 } diff --git a/clusters/mitre-intrusion-set.json b/clusters/mitre-intrusion-set.json index da49cea..89f61b4 100644 --- a/clusters/mitre-intrusion-set.json +++ b/clusters/mitre-intrusion-set.json @@ -19,7 +19,7 @@ "https://documents.trendmicro.com/assets/wp/wp-operation-woolen-goldfish.pdf", "https://iranthreats.github.io/resources/attribution-flying-rocket-kitten/", "https://www.crowdstrike.com/blog/cat-scratch-fever-crowdstrike-tracks-newly-reported-iranian-actor-flying-kitten/", - "https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-operation-saffron-rose.pdf" + "https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf" ], "synonyms": [ "Ajax Security Team", @@ -1924,23 +1924,30 @@ "value": "Deep Panda - G0009" }, { - "description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://attack.mitre.org/software/S0266) since at least 2016. [Wizard Spider](https://attack.mitre.org/groups/G0102) possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)", + "description": "[Wizard Spider](https://attack.mitre.org/groups/G0102) is a Russia-based financially motivated threat group originally known for the creation and deployment of [TrickBot](https://attack.mitre.org/software/S0266) since at least 2016. [Wizard Spider](https://attack.mitre.org/groups/G0102) possesses a diverse aresenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)", "meta": { "external_id": "G0102", "refs": [ "https://attack.mitre.org/groups/G0102", + "https://securityintelligence.com/posts/trickbot-gang-doubles-down-enterprise-infection/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/", "https://www.crowdstrike.com/blog/wizard-spider-adversary-update/", "https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html", - "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html" + "https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html", + "https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf", + "https://www.secureworks.com/research/threat-profiles/gold-blackburn" ], "synonyms": [ "Wizard Spider", "UNC1878", "TEMP.MixMaster", - "Grim Spider" + "Grim Spider", + "FIN12", + "GOLD BLACKBURN", + "ITG23", + "Periwinkle Tempest" ] }, "related": [ @@ -1958,6 +1965,13 @@ ], "type": "uses" }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", "tags": [ @@ -1979,6 +1993,13 @@ ], "type": "uses" }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "066b057c-944e-4cfc-b654-e3dfba04b926", "tags": [ @@ -2000,6 +2021,13 @@ ], "type": "uses" }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", "tags": [ @@ -2084,6 +2112,20 @@ ], "type": "uses" }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "4dea7d8e-af94-4bfb-afe4-7ff54f59308b", "tags": [ @@ -2098,6 +2140,13 @@ ], "type": "uses" }, + { + "dest-uuid": "54a649ff-439a-41a4-9856-8d144a2551ba", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", "tags": [ @@ -2112,6 +2161,13 @@ ], "type": "uses" }, + { + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "63c2a130-8a5b-452f-ad96-07cf0af12ffe", "tags": [ @@ -2119,6 +2175,20 @@ ], "type": "uses" }, + { + "dest-uuid": "64764dc6-a032-495f-8250-1e4c06bdc163", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65013dd2-bc61-43e3-afb5-a14c4fa7437a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "650c784b-7504-4df7-ab2c-4ea882384d1e", "tags": [ @@ -2126,6 +2196,13 @@ ], "type": "uses" }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", "tags": [ @@ -2140,6 +2217,13 @@ ], "type": "uses" }, + { + "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", "tags": [ @@ -2154,6 +2238,13 @@ ], "type": "uses" }, + { + "dest-uuid": "8d7bd4f5-3a89-4453-9c82-2c8894d5655e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", "tags": [ @@ -2238,6 +2329,13 @@ ], "type": "uses" }, + { + "dest-uuid": "b76b2d94-60e4-4107-a903-4a3a7622fb3b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "b77b563c-34bb-4fb8-86a3-3694338f7b47", "tags": [ @@ -2245,6 +2343,13 @@ ], "type": "uses" }, + { + "dest-uuid": "bf1b6176-597c-4600-bfcd-ac989670f96b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", "tags": [ @@ -2259,6 +2364,13 @@ ], "type": "uses" }, + { + "dest-uuid": "c8e87b83-edbb-48d4-9295-4974897525b7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "c9b99d03-ff11-4a48-95f0-82660d582c25", "tags": [ @@ -2280,6 +2392,13 @@ ], "type": "uses" }, + { + "dest-uuid": "d336b553-5da9-46ca-98a8-0b23f49fb447", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "d511a6f6-4a33-41d5-bc95-c343875d1377", "tags": [ @@ -2301,6 +2420,13 @@ ], "type": "uses" }, + { + "dest-uuid": "e33267fe-099f-4af2-8730-63d49f8813b2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", "tags": [ @@ -2308,6 +2434,27 @@ ], "type": "uses" }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "e7cbc1de-1f79-48ee-abfd-da1241c65a15", "tags": [ @@ -2364,6 +2511,13 @@ ], "type": "uses" }, + { + "dest-uuid": "f5d8eed6-48a9-4cdf-a3d7-d1ffa99c3d2a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "fb8d023d-45be-47e9-bc51-f56bcae6435b", "tags": [ @@ -5188,13 +5342,6 @@ ], "type": "uses" }, - { - "dest-uuid": "7610cada-1499-41a4-b3dd-46467b68d177", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "76551c52-b111-4884-bc47-ff3e728f0156", "tags": [ @@ -6108,6 +6255,30 @@ "uuid": "2e290bfe-93b5-48ce-97d6-edcd6d32b7cf", "value": "Gamaredon Group - G0047" }, + { + "description": "[Charming Kitten](https://attack.mitre.org/groups/G0058) is an Iranian cyber espionage group that has been active since approximately 2014. They appear to focus on targeting individuals of interest to Iran who work in academic research, human rights, and media, with most victims having been located in Iran, the US, Israel, and the UK. [[Charming Kitten](https://attack.mitre.org/groups/G0058) often tries to access private email and Facebook accounts, and sometimes establishes a foothold on victim computers as a secondary objective. The group's TTPs overlap extensively with another group, [Magic Hound](https://attack.mitre.org/groups/G0059), resulting in reporting that may not distinguish between the two groups' activities.(Citation: ClearSky Charming Kitten Dec 2017)", + "meta": { + "external_id": "G0058", + "refs": [ + "http://www.clearskysec.com/wp-content/uploads/2017/12/Charming_Kitten_2017.pdf", + "https://attack.mitre.org/groups/G0058" + ], + "synonyms": [ + "Charming Kitten" + ] + }, + "related": [ + { + "dest-uuid": "f9d6633a-55e6-4adc-9263-6ae080421a13", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], + "uuid": "92d5b3fd-3b39-438e-af68-770e447beada", + "value": "Charming Kitten - G0058" + }, { "description": "[Magic Hound](https://attack.mitre.org/groups/G0059) is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.(Citation: FireEye APT35 2018)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Secureworks COBALT ILLUSION Threat Profile)(Citation: Proofpoint TA453 July2021)", "meta": { @@ -6345,6 +6516,13 @@ ], "type": "similar" }, + { + "dest-uuid": "494ab9f0-36e0-4b06-b10d-57285b040a06", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", "tags": [ @@ -7012,6 +7190,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "c19cfc89-5ac6-4d2d-a236-70d2b32e007c", "tags": [ @@ -7433,6 +7618,61 @@ "uuid": "c77c5576-ca19-42ed-a36f-4b4486a84133", "value": "GOLD SOUTHFIELD - G0115" }, + { + "description": "[Scattered Spider](https://attack.mitre.org/groups/G1015) is a cybercriminal group that has been active since at least 2022 targeting customer relationship management and business-process outsourcing (BPO) firms as well as telecommunications and technology companies. During campaigns [Scattered Spider](https://attack.mitre.org/groups/G1015) has leveraged targeted social-engineering techniques and attempted to bypass popular endpoint security tools.(Citation: CrowdStrike Scattered Spider Profile)(Citation: CrowdStrike Scattered Spider BYOVD January 2023)(Citation: Crowdstrike TELCO BPO Campaign December 2022)", + "meta": { + "external_id": "G1015", + "refs": [ + "https://attack.mitre.org/groups/G1015", + "https://www.crowdstrike.com/adversaries/scattered-spider/", + "https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/", + "https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/" + ], + "synonyms": [ + "Scattered Spider", + "Roasted 0ktapus" + ] + }, + "related": [ + { + "dest-uuid": "10d51417-ee35-4589-b1ff-b6df1c334e8d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "954a1639-f2d6-407d-aef3-4917622ca493", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cca0ccb6-a068-4574-a722-b1556f86833a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "44d37b89-a739-4810-9111-0d2617a8939b", + "value": "Scattered Spider - G1015" + }, { "description": "[Operation Wocao](https://attack.mitre.org/groups/G0116) described activities carried out by a China-based cyber espionage adversary. [Operation Wocao](https://attack.mitre.org/groups/G0116) targeted entities within the government, managed service providers, energy, health care, and technology sectors across several countries, including China, France, Germany, the United Kingdom, and the United States. [Operation Wocao](https://attack.mitre.org/groups/G0116) used similar TTPs and tools to APT20, suggesting a possible overlap.(Citation: FoxIT Wocao December 2019)", "meta": { @@ -7518,6 +7758,13 @@ ], "type": "uses" }, + { + "dest-uuid": "2f7f03bb-f367-4a5a-ad9b-310a12a48906", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "315f51f0-6b03-4c1e-bfb2-84740afb8e21", "tags": [ @@ -7651,13 +7898,6 @@ ], "type": "uses" }, - { - "dest-uuid": "911fe4c3-444d-4e92-83b8-cc761ac5fd3b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ @@ -7789,7 +8029,370 @@ "value": "Fox Kitten - G0117" }, { - "description": "[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)", + "description": "[Volt Typhoon](https://attack.mitre.org/groups/G1017) is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021. [Volt Typhoon](https://attack.mitre.org/groups/G1017) typically focuses on espionage and information gathering and has targeted critical infrastructure organizations in the US including Guam. [Volt Typhoon](https://attack.mitre.org/groups/G1017) has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.(Citation: Microsoft Volt Typhoon May 2023)(Citation: Joint Cybersecurity Advisory Volt Typhoon June 2023)(Citation: Secureworks BRONZE SILHOUETTE May 2023)", + "meta": { + "external_id": "G1017", + "refs": [ + "https://attack.mitre.org/groups/G1017", + "https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF", + "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/", + "https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations" + ], + "synonyms": [ + "Volt Typhoon", + "BRONZE SILHOUETTE" + ] + }, + "related": [ + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "208884f1-7b83-4473-ac22-4e1cf6c41471", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "26c87906-d750-42c5-946c-d4162c73fc7b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "294e2560-bd48-44b2-9da2-833b5588ad11", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e45723a-31da-4a7e-aaa6-e01998a6788f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3975dbb5-0e1e-4f5b-bae1-cf2ab84b46dc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3fc9b85a-2862-4363-a64d-d692e3ffbee0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4664b683-f578-434f-919b-1c1aad2a1111", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5a63f900-5e7e-4928-a746-dd4558e1df71", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7fcbc4e8-1989-441f-9ac5-e7b6ff5806f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "810d8072-afb6-4a56-9ee7-86379ac4a6f3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "866d0d6d-02c6-42bd-aa2f-02907fdc0969", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "981acc4c-2ede-4b56-be6e-fa1a75f37acf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b77b563c-34bb-4fb8-86a3-3694338f7b47", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e196b5c5-8118-4a1c-ab8a-936586ce3db5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b6daca-e963-4a69-aee6-ed4fd653ad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f91162cc-1686-4ff8-8115-bf3f61a4cc7a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "174279b4-399f-4ddb-966e-5efedd1dd5f2", + "value": "Volt Typhoon - G1017" + }, + { + "description": "[Indrik Spider](https://attack.mitre.org/groups/G0119) is a Russia-based cybercriminal group that has been active since at least 2014. [Indrik Spider](https://attack.mitre.org/groups/G0119) initially started with the [Dridex](https://attack.mitre.org/software/S0384) banking Trojan, and then by 2017 they began running ransomware operations using [BitPaymer](https://attack.mitre.org/software/S0570), [WastedLocker](https://attack.mitre.org/software/S0612), and Hades ransomware. Following U.S. sanctions and an indictment in 2019, [Indrik Spider](https://attack.mitre.org/groups/G0119) changed their tactics and diversified their toolset.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)", "meta": { "external_id": "G0119", "refs": [ @@ -7839,6 +8442,13 @@ ], "type": "uses" }, + { + "dest-uuid": "212306d8-efa4-44c9-8c2d-ed3d2e224aa0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ @@ -7881,6 +8491,13 @@ ], "type": "uses" }, + { + "dest-uuid": "65013dd2-bc61-43e3-afb5-a14c4fa7437a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", "tags": [ @@ -9037,6 +9654,13 @@ ], "type": "uses" }, + { + "dest-uuid": "20fb2507-d71c-455d-9b6d-6104461cf26b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", "tags": [ @@ -9058,6 +9682,13 @@ ], "type": "uses" }, + { + "dest-uuid": "315f51f0-6b03-4c1e-bfb2-84740afb8e21", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", "tags": [ @@ -9093,6 +9724,13 @@ ], "type": "uses" }, + { + "dest-uuid": "6a5d222a-a7e0-4656-b110-782c33098289", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "6ee2dc99-91ad-4534-a7d8-a649358c331f", "tags": [ @@ -9226,6 +9864,20 @@ ], "type": "uses" }, + { + "dest-uuid": "c2f59d25-87fe-44aa-8f83-e8e59d077bf5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c9e0c59e-162e-40a4-b8b1-78fab4329ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "cc723aff-ec88-40e3-a224-5af9fd983cc4", "tags": [ @@ -10547,7 +11199,7 @@ "value": "Inception - G0100" }, { - "description": "[Turla](https://attack.mitre.org/groups/G0010) is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. [Turla](https://attack.mitre.org/groups/G0010)’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines.(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)", + "description": "[Turla](https://attack.mitre.org/groups/G0010) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. [Turla](https://attack.mitre.org/groups/G0010) is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as [Uroburos](https://attack.mitre.org/software/S0022).(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)", "meta": { "external_id": "G0010", "refs": [ @@ -10557,6 +11209,7 @@ "https://securelist.com/introducing-whitebear/81638/", "https://securelist.com/the-epic-turla-operation/65545/", "https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity", + "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf", "https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-march-venomous-bear/", "https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf", "https://www.threatminer.org/report.php?q=waterbug-attack-group.pdf&y=2015#gsc.tab=0&gsc.q=waterbug-attack-group.pdf&gsc.page=1", @@ -10598,6 +11251,13 @@ ], "type": "uses" }, + { + "dest-uuid": "09fcc02f-f9d4-43fa-8609-5e5e186b7103", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc", "tags": [ @@ -11302,6 +11962,13 @@ ], "type": "uses" }, + { + "dest-uuid": "08e844a8-371f-4fe3-9d1f-e056e64a7fde", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", "tags": [ @@ -15198,6 +15865,7 @@ "https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html", "https://www.gov.uk/government/news/russia-uk-and-us-expose-global-campaigns-of-malign-activity-by-russian-intelligence-services", "https://www.gov.uk/government/news/russia-uk-exposes-russian-involvement-in-solarwinds-cyber-compromise", + "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email", "https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/", "https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/", "https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/", @@ -15227,7 +15895,8 @@ "Cozy Bear", "CozyDuke", "SolarStorm", - "Blue Kitsune" + "Blue Kitsune", + "UNC3524" ] }, "related": [ @@ -15252,6 +15921,13 @@ ], "type": "uses" }, + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "03342581-f790-4f03-ba41-e82e67392e23", "tags": [ @@ -15294,6 +15970,20 @@ ], "type": "uses" }, + { + "dest-uuid": "132d5b37-aac5-4378-a8dc-3127b18a73dc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "199463de-d9be-46d6-bb41-07234c1dd5a6", "tags": [ @@ -15315,6 +16005,13 @@ ], "type": "uses" }, + { + "dest-uuid": "1ecfdab8-7d59-4c98-95d4-dc41970f57fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "212306d8-efa4-44c9-8c2d-ed3d2e224aa0", "tags": [ @@ -15329,6 +16026,13 @@ ], "type": "uses" }, + { + "dest-uuid": "26c87906-d750-42c5-946c-d4162c73fc7b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "294e2560-bd48-44b2-9da2-833b5588ad11", "tags": [ @@ -15399,6 +16103,13 @@ ], "type": "uses" }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "3d52e51e-f6db-4719-813c-48002a99f43a", "tags": [ @@ -15434,6 +16145,20 @@ ], "type": "uses" }, + { + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4816d361-f82b-4a18-aa05-b215e7cf9200", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "4efc3e00-72f2-466a-ab7c-8a7dc6603b19", "tags": [ @@ -15553,6 +16278,13 @@ ], "type": "uses" }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "7de1f7ac-5d0c-4c9c-8873-627202205331", "tags": [ @@ -15861,6 +16593,13 @@ ], "type": "uses" }, + { + "dest-uuid": "dca670cf-eeec-438f-8185-fd959d9ef211", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", "tags": [ @@ -17663,6 +18402,13 @@ ], "type": "uses" }, + { + "dest-uuid": "2f7f03bb-f367-4a5a-ad9b-310a12a48906", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3", "tags": [ @@ -17726,13 +18472,6 @@ ], "type": "uses" }, - { - "dest-uuid": "911fe4c3-444d-4e92-83b8-cc761ac5fd3b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", "tags": [ @@ -18089,16 +18828,19 @@ "value": "Taidoor - G0015" }, { - "description": "[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail, restaurant, and hospitality industries. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Fin8 May 2016)", + "description": "[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)", "meta": { "external_id": "G0061", "refs": [ "https://attack.mitre.org/groups/G0061", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor", "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html", + "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf", "https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html" ], "synonyms": [ - "FIN8" + "FIN8", + "Syssphinx" ] }, "related": [ @@ -18130,6 +18872,27 @@ ], "type": "uses" }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0c52f5bc-557d-4083-bd27-66d7cdb794bb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "132d5b37-aac5-4378-a8dc-3127b18a73dc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ @@ -18158,6 +18921,20 @@ ], "type": "uses" }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3553b49d-d4ae-4fb6-ab17-0adbc520c888", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", "tags": [ @@ -18179,6 +18956,13 @@ ], "type": "uses" }, + { + "dest-uuid": "54895630-efd2-4608-9c24-319de972a9eb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", "tags": [ @@ -18256,6 +19040,13 @@ ], "type": "uses" }, + { + "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "a78ae9fe-71cd-4563-9213-7b6260bd9a73", "tags": [ @@ -18277,6 +19068,20 @@ ], "type": "uses" }, + { + "dest-uuid": "b77b563c-34bb-4fb8-86a3-3694338f7b47", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b80d107d-fa0d-4b60-9684-b0433e8bdba0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ @@ -18340,6 +19145,13 @@ ], "type": "uses" }, + { + "dest-uuid": "e7cbc1de-1f79-48ee-abfd-da1241c65a15", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", "tags": [ @@ -18360,6 +19172,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "ff6caf67-ea1f-4895-b80e-4bb0fc31c6db", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "fd19bd82-1b14-49a1-a176-6cdc46b8a826", @@ -21176,13 +21995,6 @@ ], "type": "uses" }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", "tags": [ @@ -21344,6 +22156,13 @@ ], "type": "uses" }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "9db0cf3a-a3c9-4012-8268-123b9db6fd82", "tags": [ @@ -21528,22 +22347,22 @@ "meta": { "external_id": "G0067", "refs": [ - "https://adversary.crowdstrike.com/en-US/adversary/ricochet-chollima/", "https://attack.mitre.org/groups/G0067", "https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html", "https://securelist.com/operation-daybreak/75100/", "https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/", + "https://www.crowdstrike.com/adversaries/ricochet-chollima/", "https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/", "https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf" ], "synonyms": [ "APT37", - "Richochet Chollima", "InkySquid", "ScarCruft", "Reaper", "Group123", - "TEMP.Reaper" + "TEMP.Reaper", + "Ricochet Chollima" ] }, "related": [ @@ -22820,6 +23639,13 @@ ], "type": "uses" }, + { + "dest-uuid": "851e071f-208d-4c79-adc6-5974c85c78f3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", "tags": [ @@ -24017,7 +24843,7 @@ "value": "Sowbug - G0054" }, { - "description": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013 primarily targeting the U.S. retail, restaurant, and hospitality sectors, often using point-of-sale malware. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was run out of a front company called Combi Security. Since 2020 [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to a big game hunting (BGH) approach including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware as a Service (RaaS), Darkside. [FIN7](https://attack.mitre.org/groups/G0046) may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but there appears to be several groups using [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)", + "description": "[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has primarily targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, and utilities industries in the U.S. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was run out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https://attack.mitre.org/groups/G0046) shifted operations to a big game hunting (BGH) approach including use of [REvil](https://attack.mitre.org/software/S0496) ransomware and their own Ransomware as a Service (RaaS), Darkside. FIN7 may be linked to the [Carbanak](https://attack.mitre.org/groups/G0008) Group, but there appears to be several groups using [Carbanak](https://attack.mitre.org/software/S0030) malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)(Citation: Mandiant FIN7 Apr 2022)", "meta": { "external_id": "G0046", "refs": [ @@ -24030,6 +24856,7 @@ "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html", "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html", + "https://www.mandiant.com/resources/evolution-of-fin7", "https://www.secureworks.com/research/threat-profiles/gold-niagara" ], "synonyms": [ @@ -24075,6 +24902,20 @@ ], "type": "uses" }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "045d0922-2310-4e60-b5e4-3302302cb3c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "04fc1842-f9e4-47cf-8cb8-5c61becad142", "tags": [ @@ -24159,6 +25000,13 @@ ], "type": "uses" }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", "tags": [ @@ -24180,6 +25028,13 @@ ], "type": "uses" }, + { + "dest-uuid": "31fe0ba2-62fd-4fd9-9293-4043d84f7fe9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "32901740-b42c-4fdd-bc02-345b5dc57082", "tags": [ @@ -24201,6 +25056,20 @@ ], "type": "uses" }, + { + "dest-uuid": "3ee16395-03f0-4690-a32e-69ce9ada0f9e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4061e78c-1284-44b4-9116-73e4ac3912f7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3", "tags": [ @@ -24229,6 +25098,13 @@ ], "type": "uses" }, + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf", "tags": [ @@ -24264,6 +25140,13 @@ ], "type": "uses" }, + { + "dest-uuid": "88d31120-5bc7-4ce3-a9c0-7cf147be8e54", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "8fc6c9e7-a162-4ca4-a488-f1819e9a7b06", "tags": [ @@ -24299,6 +25182,13 @@ ], "type": "uses" }, + { + "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "a7881f21-e978-4fe4-af56-92c9416a2616", "tags": [ @@ -24341,6 +25231,13 @@ ], "type": "uses" }, + { + "dest-uuid": "bd369cd9-abb8-41ce-b5bb-fff23ee86c00", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "bd7a9e13-69fa-4243-a5e5-04326a63f9f2", "tags": [ @@ -28058,6 +28955,694 @@ "uuid": "6fe8a2a1-a1b0-4af8-953d-4babd329f8f8", "value": "BlackTech - G0098" }, + { + "description": "[TA2541](https://attack.mitre.org/groups/G1018) is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. [TA2541](https://attack.mitre.org/groups/G1018) campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)", + "meta": { + "external_id": "G1018", + "refs": [ + "https://attack.mitre.org/groups/G1018", + "https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/", + "https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight" + ], + "synonyms": [ + "TA2541" + ] + }, + "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "132d5b37-aac5-4378-a8dc-3127b18a73dc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2a70812b-f1ef-44db-8578-a496a227aef2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ee16395-03f0-4690-a32e-69ce9ada0f9e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "40f5caa0-4cb7-4117-89fc-d421bb493df3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4327aff5-f194-440c-b499-4d9730cc1eab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6a5947f3-1a36-4653-8734-526df3e1d28d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7807d3a4-a885-4639-a786-c1ed41484970", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "840a987a-99bd-4a80-a5c9-0cb2baa6cade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "88d31120-5bc7-4ce3-a9c0-7cf147be8e54", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f8cd191-902c-4e83-bf20-b57c8c4640e9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac08589e-ee59-4935-8667-d845e38fe579", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bdb27a1d-1844-42f1-a0c0-826027ae0326", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d906e6f7-434c-44c0-b51a-ed50af8f7945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e7a5229f-05eb-440e-b982-9a6d2b2b87c8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "efece7e8-e40b-49c2-9f84-c55c5c93d05c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "fde19a18-e502-467f-be14-58c71b4e7f4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "467271fd-47c0-4e90-a3f9-d84f5cf790d0", + "value": "TA2541 - G1018" + }, + { + "description": "[FIN13](https://attack.mitre.org/groups/G1016) is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. [FIN13](https://attack.mitre.org/groups/G1016) achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)", + "meta": { + "external_id": "G1016", + "refs": [ + "https://attack.mitre.org/groups/G1016", + "https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf?__hstc=147695848.3e8f1a482c8f8d4531507747318e660b.1680005306711.1680005306711.1680005306711.1&__hssc=147695848.1.1680005306711&__hsfp=3000179024&hsCtaTracking=189ec409-ae2d-4909-8bf1-62dcdd694372%7Cca91d317-8f10-4a38-9f80-367f551ad64d", + "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico" + ], + "synonyms": [ + "FIN13", + "Elephant Beetle" + ] + }, + "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "00f90846-cbd1-4fc5-9233-df5c2bf2a662", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a68f1f1-da74-4d28-8d9a-696c082706cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "10d51417-ee35-4589-b1ff-b6df1c334e8d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "132d5b37-aac5-4378-a8dc-3127b18a73dc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "15dbf668-795c-41e6-8219-f0447c0e64ce", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1644e709-12d2-41e5-a60f-3470991f5011", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "212306d8-efa4-44c9-8c2d-ed3d2e224aa0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "21875073-b0ee-49e3-9077-1e2a885359af", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "26c87906-d750-42c5-946c-d4162c73fc7b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2db31dcd-54da-405d-acef-b9129b816ed6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3433a9e8-1c47-4320-b9bf-ed449061d1c3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "34ab90a3-05f6-4259-8f21-621081fdaba5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3f886f2a-874f-4333-b794-aa6075009b1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "42e8de7b-37b2-4258-905a-6897815e58e0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4f9ca633-15c5-463c-9724-bdcd54fde541", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5282dd9a-d26d-4e16-88b7-7c0f4553daf4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5d0d3609-d06d-49e1-b9c9-b544e0c618cb", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "60d0c01d-e2bf-49dd-a453-f8a9c9fa6f65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6151cbea-819b-455a-9fa6-99a1cc58797d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "635cbe30-392d-4e27-978e-66774357c762", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "65f2d882-3f41-4d48-8a06-29af77ec9f90", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "72b74d71-8169-42aa-92e0-e7b04b9f5a08", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "851e071f-208d-4c79-adc6-5974c85c78f3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8cdeb020-e31e-4f88-a582-f53dcfbda819", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a10641f4-87b4-45a3-a906-92a149cb2c27", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a2fdce72-04b2-409a-ac10-cc1695f4fce0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ac9e6b22-11bf-45d7-9181-c1cb08360931", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "afc079f3-c0ea-4096-b75d-3f05338b7f60", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "eb062747-2193-45de-8fa2-e62549c37ddf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec8fc7e2-b356-455c-8db5-2e37be158e7d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "edf91964-b26e-4b4a-9600-ccacd7d7df24", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4c1826f-a322-41cd-9557-562100848c84", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f6dacc85-b37d-458e-b58d-74fc4bbf5755", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "fd66436e-4d33-450e-ac4c-f7810f1c85f4", + "value": "FIN13 - G1016" + }, { "description": "[UNC2452](https://attack.mitre.org/groups/G0118) is a suspected Russian state-sponsored threat group responsible for the 2020 SolarWinds software supply chain intrusion.(Citation: FireEye SUNBURST Backdoor December 2020) Victims of this campaign include government, consulting, technology, telecom, and other organizations in North America, Europe, Asia, and the Middle East.(Citation: FireEye SUNBURST Backdoor December 2020) The group also compromised at least one think tank by late 2019.(Citation: Volexity SolarWinds)", "meta": { @@ -29600,6 +31185,107 @@ "uuid": "b7f627e2-0817-4cd5-8d50-e75f8aa85cc6", "value": "LuminousMoth - G1014" }, + { + "description": "[MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)", + "meta": { + "external_id": "G1019", + "refs": [ + "https://attack.mitre.org/groups/G1019", + "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" + ], + "synonyms": [ + "MoustachedBouncer" + ] + }, + "related": [ + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1fefb062-feda-484a-8f10-0cebf65e20e3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "359b00ad-9425-420b-bba5-6de8d600cbc0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43c9bc06-715b-42db-972f-52d25c09a20c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "91c57ed3-7c32-4c68-b388-7db00cb8dac6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b21c3b2d-02e6-45b1-980b-e69051040839", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "deb98323-e13f-4b0c-8d94-175379069062", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1445afd-c359-45ed-8f27-626dc4d5e157", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "7251b44b-6072-476c-b8d9-a6e32c355b28", + "value": "MoustachedBouncer - G1019" + }, { "description": "[CostaRicto](https://attack.mitre.org/groups/G0132) is a suspected hacker-for-hire cyber espionage campaign that has targeted multiple industries worldwide since at least 2019. [CostaRicto](https://attack.mitre.org/groups/G0132)'s targets, a large portion of which are financial institutions, are scattered across Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia.(Citation: BlackBerry CostaRicto November 2020)", "meta": { @@ -29639,6 +31325,13 @@ ], "type": "uses" }, + { + "dest-uuid": "15d78a95-af6a-4b06-8dae-76bedb0ec5a1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ @@ -29771,6 +31464,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "feae299d-e34f-4fc9-8545-486d0905bd41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "6eded342-33e5-4451-b6b2-e1c62863129f", @@ -31343,5 +33043,5 @@ "value": "TeamTNT - G0139" } ], - "version": 31 + "version": 32 } diff --git a/clusters/mitre-malware.json b/clusters/mitre-malware.json index 523ed4a..4deb4ee 100644 --- a/clusters/mitre-malware.json +++ b/clusters/mitre-malware.json @@ -64,6 +64,13 @@ ], "type": "similar" }, + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "3e2c99f9-66cd-48be-86e9-d7c1c164d87c", "tags": [ @@ -98,6 +105,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -736,6 +750,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", "tags": [ @@ -834,6 +855,13 @@ ], "type": "similar" }, + { + "dest-uuid": "5abfc5e6-3c56-49e7-ad72-502d01acf28b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", "tags": [ @@ -2081,6 +2109,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -3439,6 +3474,13 @@ ], "type": "uses" }, + { + "dest-uuid": "494ab9f0-36e0-4b06-b10d-57285b040a06", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "53ac20cd-aca3-406e-9aa0-9fc7fdc60a5a", "tags": [ @@ -3855,13 +3897,6 @@ ], "type": "uses" }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", "tags": [ @@ -4023,6 +4058,13 @@ ], "type": "uses" }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "a01bf75f-00b2-4568-a58f-565ff9bf202b", "tags": [ @@ -5943,6 +5985,13 @@ ], "type": "uses" }, + { + "dest-uuid": "6836813e-8ec8-4375-b459-abb388cb1a35", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf", "tags": [ @@ -5971,13 +6020,6 @@ ], "type": "uses" }, - { - "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "be055942-6e63-49d7-9fa1-9cb7d8a8f3f4", "tags": [ @@ -6311,6 +6353,13 @@ ], "type": "uses" }, + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -7551,6 +7600,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "3775a580-a1d1-46c4-8147-c614a715f2e9", "tags": [ @@ -7592,6 +7648,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -8194,7 +8257,7 @@ "value": "macOS.OSAMiner - S1048" }, { - "description": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) is a MacOS backdoor with several variants that has been used by [APT32](https://attack.mitre.org/groups/G0050).(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)", + "description": "[OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) is a macOS backdoor used by [APT32](https://attack.mitre.org/groups/G0050). First discovered in 2015, [APT32](https://attack.mitre.org/groups/G0050) has continued to make improvements using a plugin architecture to extend capabilities, specifically using `.dylib` files. [OSX_OCEANLOTUS.D](https://attack.mitre.org/software/S0352) can also determine it's permission level and execute according to access type (`root` or `user`).(Citation: Unit42 OceanLotus 2017)(Citation: TrendMicro MacOS April 2018)(Citation: Trend Micro MacOS Backdoor November 2020)", "meta": { "external_id": "S0352", "mitre_platforms": [ @@ -8203,6 +8266,7 @@ "refs": [ "https://attack.mitre.org/software/S0352", "https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-backdoor-linked-to-oceanlotus-found/", + "https://unit42.paloaltonetworks.com/unit42-new-improved-macos-backdoor-oceanlotus/", "https://www.trendmicro.com/en_us/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html" ], "synonyms": [ @@ -8211,6 +8275,13 @@ ] }, "related": [ + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "09b130a2-a77e-4af0-a361-f46f9aad1345", "tags": [ @@ -8218,6 +8289,13 @@ ], "type": "uses" }, + { + "dest-uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "143c0cbb-a297-4142-9624-87ffc778980b", "tags": [ @@ -8225,6 +8303,20 @@ ], "type": "uses" }, + { + "dest-uuid": "208884f1-7b83-4473-ac22-4e1cf6c41471", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", "tags": [ @@ -8253,6 +8345,20 @@ ], "type": "uses" }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "41868330-6ee2-4d0f-b743-9f2294c3c9b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", "tags": [ @@ -8295,6 +8401,13 @@ ], "type": "uses" }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", "tags": [ @@ -8302,6 +8415,13 @@ ], "type": "uses" }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "d10cbd34-42e3-45c0-84d2-535a09849584", "tags": [ @@ -8433,6 +8553,13 @@ ], "type": "uses" }, + { + "dest-uuid": "4a2975db-414e-4c0c-bd92-775987514b4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", "tags": [ @@ -9341,7 +9468,7 @@ "value": "CosmicDuke - S0050" }, { - "description": "[Doki](https://attack.mitre.org/software/S0600) is a backdoor that uses a unique Dogecoin-based Domain Generation Algorithm and was first observed in July 2020. [Doki](https://attack.mitre.org/software/S0600) was used in conjunction with the [Ngrok](https://attack.mitre.org/software/S0508) Mining Botnet in a campaign that targeted Docker servers in cloud platforms. (Citation: Intezer Doki July 20)", + "description": "[Doki](https://attack.mitre.org/software/S0600) is a backdoor that uses a unique Dogecoin-based Domain Generation Algorithm and was first observed in July 2020. [Doki](https://attack.mitre.org/software/S0600) was used in conjunction with the [ngrok](https://attack.mitre.org/software/S0508) Mining Botnet in a campaign that targeted Docker servers in cloud platforms. (Citation: Intezer Doki July 20)", "meta": { "external_id": "S0600", "mitre_platforms": [ @@ -9728,6 +9855,32 @@ "uuid": "95047f03-4811-4300-922e-1ba937d53a61", "value": "Hikit - S0009" }, + { + "description": "", + "meta": { + "external_id": "S9000", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S9000" + ], + "synonyms": [ + "Ngrok" + ] + }, + "related": [ + { + "dest-uuid": "2f7f03bb-f367-4a5a-ad9b-310a12a48906", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "revoked-by" + } + ], + "uuid": "911fe4c3-444d-4e92-83b8-cc761ac5fd3b", + "value": "Ngrok - S9000" + }, { "description": "[Rover](https://attack.mitre.org/software/S0090) is malware suspected of being used for espionage purposes. It was used in 2015 in a targeted email sent to an Indian Ambassador to Afghanistan. (Citation: Palo Alto Rover)", "meta": { @@ -10871,6 +11024,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "4c58b7c6-a839-4789-bda9-9de33e4d4512", "tags": [ @@ -13248,6 +13408,103 @@ "uuid": "7551188b-8f91-4d34-8350-0d0c57b2b913", "value": "Elise - S0081" }, + { + "description": "[Fakecalls](https://attack.mitre.org/software/S1080) is an Android trojan, first detected in January 2021, that masquerades as South Korean banking apps. It has capabilities to intercept calls to banking institutions and even maintain realistic dialogues with the victim using pre-recorded audio snippets.(Citation: kaspersky_fakecalls_0422) ", + "meta": { + "external_id": "S1080", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S1080", + "https://www.kaspersky.com/blog/fakecalls-banking-trojan/44072/" + ], + "synonyms": [ + "Fakecalls" + ] + }, + "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1d1b1558-c833-482e-aabb-d07ef6eae63d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32063d7f-0a39-440d-a4a3-2694488f96cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ab7400b7-3476-4776-9545-ef3fa373de63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c6421411-ae61-42bb-9098-73fddb315002", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "429e1526-6293-495b-8808-af7f9a66c4be", + "value": "Fakecalls - S1080" + }, { "description": "[Sykipot](https://attack.mitre.org/software/S0018) is malware that has been used in spearphishing campaigns since approximately 2007 against victims primarily in the US. One variant of [Sykipot](https://attack.mitre.org/software/S0018) hijacks smart cards on victims. (Citation: Alienvault Sykipot DOD Smart Cards) The group using this malware has also been referred to as Sykipot. (Citation: Blasco 2013)", "meta": { @@ -13515,6 +13772,173 @@ "uuid": "495b6cdb-7b5a-4fbc-8d33-e7ef68806d08", "value": "Volgmer - S0180" }, + { + "description": "[NightClub](https://attack.mitre.org/software/S1090) is a modular implant written in C++ that has been used by [MoustachedBouncer](https://attack.mitre.org/groups/G1019) since at least 2014.(Citation: MoustachedBouncer ESET August 2023)", + "meta": { + "external_id": "S1090", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1090", + "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" + ], + "synonyms": [ + "NightClub" + ] + }, + "related": [ + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1035cdf2-3e5f-446f-a7a7-e8f6d7925967", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "47f2d673-ca62-47e9-929b-1b0be9657611", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4ae4f953-fe58-4cc8-a327-33257e30a830", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d467bc38-284b-4a00-96ac-125f447799fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "91c57ed3-7c32-4c68-b388-7db00cb8dac6", + "value": "NightClub - S1090" + }, { "description": "[Epic](https://attack.mitre.org/software/S0091) is a backdoor that has been used by [Turla](https://attack.mitre.org/groups/G0010). (Citation: Kaspersky Turla)", "meta": { @@ -13737,13 +14161,6 @@ ], "type": "uses" }, - { - "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, { "dest-uuid": "4cbe9373-6b5e-42d0-9750-e0b7fc0d58bb", "tags": [ @@ -13772,6 +14189,13 @@ ], "type": "uses" }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "b4b7458f-81f2-4d38-84be-1c5ba0167a52", "tags": [ @@ -13867,15 +14291,39 @@ "value": "Chaos - S0220" }, { - "description": "[Uroburos](https://attack.mitre.org/software/S0022) is a rootkit used by [Turla](https://attack.mitre.org/groups/G0010). (Citation: Kaspersky Turla)", + "description": "[Uroburos](https://attack.mitre.org/software/S0022) is a sophisticated cyber espionage tool written in C that has been used by units within Russia's Federal Security Service (FSB) associated with the [Turla](https://attack.mitre.org/groups/G0010) toolset to collect intelligence on sensitive targets worldwide. [Uroburos](https://attack.mitre.org/software/S0022) has several variants and has undergone nearly constant upgrade since its initial development in 2003 to keep it viable after public disclosures. [Uroburos](https://attack.mitre.org/software/S0022) is typically deployed to external-facing nodes on a targeted network and has the ability to leverage additional tools and TTPs to further exploit an internal network. [Uroburos](https://attack.mitre.org/software/S0022) has interoperable implants for Windows, Linux, and macOS, employs a high level of stealth in communications and architecture, and can easily incorporate new or replacement components.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)(Citation: Kaspersky Turla)", "meta": { "external_id": "S0022", + "mitre_platforms": [ + "Linux", + "Windows", + "macOS" + ], "refs": [ "https://attack.mitre.org/software/S0022", - "https://securelist.com/the-epic-turla-operation/65545/" + "https://securelist.com/the-epic-turla-operation/65545/", + "https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf" + ], + "synonyms": [ + "Uroburos", + "Snake" ] }, "related": [ + { + "dest-uuid": "02c5abff-30bf-4703-ab92-1f6072fae939", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0533ab23-3f7d-463f-9bd8-634d27e4dee1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b", "tags": [ @@ -13883,6 +14331,13 @@ ], "type": "uses" }, + { + "dest-uuid": "1996eef1-ced3-4d7f-bf94-33298cabbf72", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "22332d52-c0c2-443c-9ffb-f08c0d23722c", "tags": [ @@ -13890,6 +14345,181 @@ ], "type": "similar" }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2959d63f-73fd-46a1-abd2-109d7dcede32", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "451a9977-d255-43c9-b431-66de80130c8c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "54b4c251-1f0e-4eba-ba6b-dbc7a6f6f06b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57340c81-c025-4189-8fa0-fc7ede51bae4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "84e02621-8fdf-470f-bd58-993bb6a89d91", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a782ebe2-daba-42c7-bc82-e8e9d923162d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c325b232-d5bc-4dde-a3ec-71f3db9e8adc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d467bc38-284b-4a00-96ac-125f447799fc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "d674ffd2-1f27-403b-8fe9-b4af6e303e5c", "tags": [ @@ -13903,6 +14533,48 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfebc3b7-d19d-450b-81c7-6dafe4184c04", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f7c0689c-4dbd-489b-81be-7cb7c7079ade", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "80a014ba-3fef-4768-990b-37d8bd10d7f4", @@ -14150,6 +14822,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "1d1b1558-c833-482e-aabb-d07ef6eae63d", "tags": [ @@ -19799,6 +20478,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "2282a98b-5049-4f61-9381-55baca7c1add", "tags": [ @@ -20610,6 +21296,13 @@ ], "type": "uses" }, + { + "dest-uuid": "dc01774a-d1c1-45fb-b506-0a5d1d6593d9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", "tags": [ @@ -21192,6 +21885,13 @@ ], "type": "uses" }, + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -21772,6 +22472,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -22115,6 +22822,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "1d1b1558-c833-482e-aabb-d07ef6eae63d", "tags": [ @@ -23041,64 +23755,6 @@ "uuid": "2fb26586-2b53-4b9a-ad4f-2b3bcb9a2421", "value": "SslMM - S0058" }, - { - "description": "[Ngrok](https://attack.mitre.org/software/S0508) is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. [Ngrok](https://attack.mitre.org/software/S0508) has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.(Citation: Zdnet Ngrok September 2018)(Citation: FireEye Maze May 2020)(Citation: Cyware Ngrok May 2019)(Citation: MalwareBytes LazyScripter Feb 2021)", - "meta": { - "external_id": "S0508", - "mitre_platforms": [ - "Windows" - ], - "refs": [ - "https://attack.mitre.org/software/S0508", - "https://cyware.com/news/cyber-attackers-leverage-tunneling-service-to-drop-lokibot-onto-victims-systems-6f610e44", - "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", - "https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf", - "https://www.zdnet.com/article/sly-malware-author-hides-cryptomining-botnet-behind-ever-shifting-proxy-service/" - ], - "synonyms": [ - "Ngrok" - ] - }, - "related": [ - { - "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - }, - { - "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", - "tags": [ - "estimative-language:likelihood-probability=\"almost-certain\"" - ], - "type": "uses" - } - ], - "uuid": "911fe4c3-444d-4e92-83b8-cc761ac5fd3b", - "value": "Ngrok - S0508" - }, { "description": "[FakeSpy](https://attack.mitre.org/software/S0509) is Android spyware that has been operated by the Chinese threat actor behind the Roaming Mantis campaigns.(Citation: Cybereason FakeSpy)", "meta": { @@ -23115,6 +23771,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -24425,7 +25088,7 @@ "https://www.dragos.com/wp-content/uploads/TRISIS-01.pdf", "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html", "https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-TRITON-and-tristation.html", - "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html " + "https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html" ], "synonyms": [ "TRITON", @@ -27864,6 +28527,272 @@ "uuid": "7343e208-7cab-45f2-a47b-41ba5e2f0fab", "value": "XTunnel - S0117" }, + { + "description": "[BADHATCH](https://attack.mitre.org/software/S1081) is a backdoor that has been utilized by [FIN8](https://attack.mitre.org/groups/G0061) since at least 2019. [BADHATCH](https://attack.mitre.org/software/S1081) has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.(Citation: Gigamon BADHATCH Jul 2019)(Citation: BitDefender BADHATCH Mar 2021)", + "meta": { + "external_id": "S1081", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1081", + "https://blog.gigamon.com/2019/07/23/abadbabe-8badf00d-discovering-badhatch-and-a-detailed-look-at-fin8s-tooling/", + "https://www.bitdefender.com/files/News/CaseStudies/study/394/Bitdefender-PR-Whitepaper-BADHATCH-creat5237-en-EN.pdf" + ], + "synonyms": [ + "BADHATCH" + ] + }, + "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0533ab23-3f7d-463f-9bd8-634d27e4dee1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "120d5519-3098-4e1c-9191-2aa61232f073", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aed01ad-3df3-4410-a8cb-11ea4ded587c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "767dbf9e-df3f-45cb-8998-4903ab5f80c0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7c0f17c9-1af6-4628-9cbd-9e45482dd605", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d511a6f6-4a33-41d5-bc95-c343875d1377", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d63a3fb8-9452-4e9d-a60a-54be68d5998c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e358d692-23c0-4a31-9eb6-ecc13a8d7735", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e624264c-033a-424d-9fd7-fc9c3bbdb03e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f3c544dc-673c-4ef3-accb-53229f1ae077", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f4599aa0-4f85-4a32-80ea-fc39dc965945", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "3553b49d-d4ae-4fb6-ab17-0adbc520c888", + "value": "BADHATCH - S1081" + }, { "description": "[FALLCHILL](https://attack.mitre.org/software/S0181) is a RAT that has been used by [Lazarus Group](https://attack.mitre.org/groups/G0032) since at least 2016 to target the aerospace, telecommunications, and finance industries. It is usually dropped by other [Lazarus Group](https://attack.mitre.org/groups/G0032) malware or delivered when a victim unknowingly visits a compromised website. (Citation: US-CERT FALLCHILL Nov 2017)", "meta": { @@ -32488,6 +33417,145 @@ "uuid": "a5528622-3a8a-4633-86ce-8cdaf8423858", "value": "FinFisher - S0182" }, + { + "description": "[Sunbird](https://attack.mitre.org/software/S1082) is one of two mobile malware families known to be used by the APT [Confucius](https://attack.mitre.org/groups/G0142). Analysis suggests that [Sunbird](https://attack.mitre.org/software/S1082) was first active in early 2017. While [Sunbird](https://attack.mitre.org/software/S1082) and [Hornbill](https://attack.mitre.org/software/S1077) overlap in core capabilities, [Sunbird](https://attack.mitre.org/software/S1082) has a more extensive set of malicious features.(Citation: lookout_hornbill_sunbird_0221)", + "meta": { + "external_id": "S1082", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S1082", + "https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict" + ], + "synonyms": [ + "Sunbird" + ] + }, + "related": [ + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1d1b1558-c833-482e-aabb-d07ef6eae63d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32063d7f-0a39-440d-a4a3-2694488f96cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "693cdbff-ea73-49c6-ac3f-91e7285c31d1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9c049d7b-c92a-4733-9381-27e2bd2ccadc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "a9fa0d30-a8ff-45bf-922e-7720da0b7922", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b936a4-6321-4172-9114-038a866362ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "feae299d-e34f-4fc9-8545-486d0905bd41", + "value": "Sunbird - S1082" + }, { "description": "[WINERACK](https://attack.mitre.org/software/S0219) is a backdoor used by [APT37](https://attack.mitre.org/groups/G0067). (Citation: FireEye APT37 Feb 2018)", "meta": { @@ -32593,6 +33661,138 @@ "uuid": "c709da93-20c3-4d17-ab68-48cba76b2137", "value": "PJApps - S0291" }, + { + "description": "[Escobar](https://attack.mitre.org/software/S1092) is an Android banking trojan, first detected in March 2021, believed to be a new variant of AbereBot.(Citation: Bleeipng Computer Escobar)", + "meta": { + "external_id": "S1092", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S1092", + "https://www.bleepingcomputer.com/news/security/android-malware-escobar-steals-your-google-authenticator-mfa-codes/" + ], + "synonyms": [ + "Escobar" + ] + }, + "related": [ + { + "dest-uuid": "0b761f2b-197a-40f2-b100-8152cb957c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0cdd66ad-26ac-4338-a764-4972a1e17ee3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1d1b1558-c833-482e-aabb-d07ef6eae63d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "351ddf79-2d3a-41b4-9bef-82ea5d3ccd69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "39dd7871-f59b-495f-a9a5-3cb8cc50c9b2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4c58b7c6-a839-4789-bda9-9de33e4d4512", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b1c95426-2550-4621-8028-ceebf28b3a47", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b327a9c0-e709-495c-aa6e-00b042136e2b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c6421411-ae61-42bb-9098-73fddb315002", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cf28ca46-1fd3-46b4-b1f6-ec0b72361848", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfe29258-ce59-421c-9dee-e85cb9fa90cd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "ec13d292-6d8d-4c7a-b07c-a2bd2402569a", + "value": "Escobar - S1092" + }, { "description": "[DCSrv](https://attack.mitre.org/software/S1033) is destructive malware that has been used by [Moses Staff](https://attack.mitre.org/groups/G1009) since at least September 2021. Though [DCSrv](https://attack.mitre.org/software/S1033) has ransomware-like capabilities, [Moses Staff](https://attack.mitre.org/groups/G1009) does not demand ransom or offer a decryption key.(Citation: Checkpoint MosesStaff Nov 2021)", "meta": { @@ -34234,6 +35434,167 @@ "uuid": "17b40f60-729f-4fe8-8aea-cc9ee44a95d5", "value": "RedLeaves - S0153" }, + { + "description": "[Snip3](https://attack.mitre.org/software/S1086) is a sophisticated crypter-as-a-service that has been used since at least 2021 to obfuscate and load numerous strains of malware including [AsyncRAT](https://attack.mitre.org/software/S1087), [Revenge RAT](https://attack.mitre.org/software/S0379), [Agent Tesla](https://attack.mitre.org/software/S0331), and [NETWIRE](https://attack.mitre.org/software/S0198).(Citation: Morphisec Snip3 May 2021)(Citation: Telefonica Snip3 December 2021)", + "meta": { + "external_id": "S1086", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1086", + "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader", + "https://telefonicatech.com/blog/snip3-investigacion-malware" + ], + "synonyms": [ + "Snip3" + ] + }, + "related": [ + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2b742742-28c3-4e1b-bab7-8350d6300fa7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "5bfccc3f-2326-4112-86cc-c1ece9d8a2b5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "84e02621-8fdf-470f-bd58-993bb6a89d91", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b200542e-e877-4395-875b-cf1a44537ca4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d742a578-d70e-4d0e-96a6-02a9c30204e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ef67e13e-5598-4adc-bdb2-998225874fa9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "4327aff5-f194-440c-b499-4d9730cc1eab", + "value": "Snip3 - S1086" + }, { "description": "[USBStealer](https://attack.mitre.org/software/S0136) is malware that has been used by [APT28](https://attack.mitre.org/groups/G0007) since at least 2005 to extract information from air-gapped networks. It does not have the capability to communicate over the Internet and has been used in conjunction with [ADVSTORESHELL](https://attack.mitre.org/software/S0045). (Citation: ESET Sednit USBStealer 2014) (Citation: Kaspersky Sofacy)", "meta": { @@ -35338,6 +36699,152 @@ "uuid": "432555de-63bf-4f2a-a3fa-f720a4561078", "value": "FlawedAmmyy - S0381" }, + { + "description": "[Chameleon](https://attack.mitre.org/software/S1083) is an Android banking trojan that can leverage Android’s Accessibility Services to perform malicious activities. Believed to have been first active in January 2023, [Chameleon](https://attack.mitre.org/software/S1083) has been observed targeting users in Australia and Poland by masquerading as official apps.(Citation: cyble_chameleon_0423)", + "meta": { + "external_id": "S1083", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S1083", + "https://cyble.com/blog/chameleon-a-new-android-malware-spotted-in-the-wild/" + ], + "synonyms": [ + "Chameleon" + ] + }, + "related": [ + { + "dest-uuid": "0d4e3bbb-7af5-4c88-a215-0c0906bc1e8d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2282a98b-5049-4f61-9381-55baca7c1add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2aa78dfd-cb6f-4c70-9408-137cfd96be49", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32063d7f-0a39-440d-a4a3-2694488f96cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "39dd7871-f59b-495f-a9a5-3cb8cc50c9b2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4c58b7c6-a839-4789-bda9-9de33e4d4512", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6ffad4be-bfe0-424f-abde-4d9a84a800ad", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "948a447c-d783-4ba0-8516-a64140fcacd5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b1c95426-2550-4621-8028-ceebf28b3a47", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c6421411-ae61-42bb-9098-73fddb315002", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dc01774a-d1c1-45fb-b506-0a5d1d6593d9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "2cf00c5a-857d-4cb6-8f03-82f15bee0f6f", + "value": "Chameleon - S1083" + }, { "description": "[HAWKBALL](https://attack.mitre.org/software/S0391) is a backdoor that was observed in targeting of the government sector in Central Asia.(Citation: FireEye HAWKBALL Jun 2019)", "meta": { @@ -35883,6 +37390,68 @@ "uuid": "00c3bfcb-99bd-4767-8c03-b08f585f5c8a", "value": "PowerDuke - S0139" }, + { + "description": "[FlyTrap](https://attack.mitre.org/software/S1093) is an Android trojan, first detected in March 2021, that uses social engineering tactics to compromise Facebook accounts. [FlyTrap](https://attack.mitre.org/software/S1093) was initially detected through infected apps on the Google Play store, and is believed to have impacted over 10,000 victims across at least 140 countries.(Citation: Trend Micro FlyTrap) ", + "meta": { + "external_id": "S1093", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S1093", + "https://news.trendmicro.com/2021/08/17/flytrap-android-malware-is-taking-over-facebook-accounts-protect-yourself-with-a-malware-scanner/" + ], + "synonyms": [ + "FlyTrap" + ] + }, + "related": [ + { + "dest-uuid": "2282a98b-5049-4f61-9381-55baca7c1add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32063d7f-0a39-440d-a4a3-2694488f96cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4c58b7c6-a839-4789-bda9-9de33e4d4512", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "8338393c-cb2e-4ee6-b944-34672499c785", + "value": "FlyTrap - S1093" + }, { "description": "[BabyShark](https://attack.mitre.org/software/S0414) is a Microsoft Visual Basic (VB) script-based malware family that is believed to be associated with several North Korean campaigns. (Citation: Unit42 BabyShark Feb 2019)", "meta": { @@ -37851,6 +39420,75 @@ "uuid": "9abdda30-08e0-4ab1-9cf0-d447654c6de9", "value": "Kobalos - S0641" }, + { + "description": "[ANDROMEDA](https://attack.mitre.org/software/S1074) is commodity malware that was widespread in the early 2010's and continues to be observed in infections across a wide variety of industries. During the 2022 [C0026](https://attack.mitre.org/campaigns/C0026) campaign, threat actors re-registered expired [ANDROMEDA](https://attack.mitre.org/software/S1074) C2 domains to spread malware to select targets in Ukraine.(Citation: Mandiant Suspected Turla Campaign February 2023)", + "meta": { + "external_id": "S1074", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1074", + "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity" + ], + "synonyms": [ + "ANDROMEDA" + ] + }, + "related": [ + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "208884f1-7b83-4473-ac22-4e1cf6c41471", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3b744087-9945-4a6f-91e8-9dbceda417a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43e7dc91-05b2-474c-b9ac-2ed4fe101f4d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9efb1ea7-c37b-4595-9640-b7680cd84279", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "dcd9548e-df9e-47c2-81f3-bc084289959d", + "value": "ANDROMEDA - S1074" + }, { "description": "[GRIFFON](https://attack.mitre.org/software/S0417) is a JavaScript backdoor used by [FIN7](https://attack.mitre.org/groups/G0046). (Citation: SecureList Griffon May 2019)", "meta": { @@ -38236,6 +39874,61 @@ "uuid": "d2c7f8ad-3b50-4cfa-bbb1-799eff06fb40", "value": "build_downer - S0471" }, + { + "description": "[QUIETEXIT](https://attack.mitre.org/software/S1084) is a novel backdoor, based on the open-source Dropbear SSH client-server software, that has been used by [APT29](https://attack.mitre.org/groups/G0016) since at least 2021. [APT29](https://attack.mitre.org/groups/G0016) has deployed [QUIETEXIT](https://attack.mitre.org/software/S1084) on opaque network appliances that typically don't support antivirus or endpoint detection and response tools within a victim environment.(Citation: Mandiant APT29 Eye Spy Email Nov 22)", + "meta": { + "external_id": "S1084", + "mitre_platforms": [ + "Network" + ], + "refs": [ + "https://attack.mitre.org/software/S1084", + "https://www.mandiant.com/resources/blog/unc3524-eye-spy-email" + ], + "synonyms": [ + "QUIETEXIT" + ] + }, + "related": [ + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "355be19c-ffc9-46d5-8d50-d6a036c675b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "69b8fd78-40e8-4600-ae4d-662c9d7afdb3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f24faf46-3b26-4dbb-98f2-63460498e433", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "4816d361-f82b-4a18-aa05-b215e7cf9200", + "value": "QUIETEXIT - S1084" + }, { "description": "[POWRUNER](https://attack.mitre.org/software/S0184) is a PowerShell script that sends and receives commands to and from the C2 server. (Citation: FireEye APT34 Dec 2017)", "meta": { @@ -38421,6 +40114,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -38875,6 +40575,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "3775a580-a1d1-46c4-8147-c614a715f2e9", "tags": [ @@ -39293,6 +41000,13 @@ ], "type": "uses" }, + { + "dest-uuid": "28fdd23d-aee3-4afe-bc3f-5f1f52929258", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "2bb20118-e6c0-41dc-a07c-283ea4dd0fb8", "tags": [ @@ -39450,6 +41164,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -40370,6 +42091,117 @@ "uuid": "fd6d56b2-d84e-4d2a-b37d-d4678d3e08a6", "value": "TianySpy - S1056" }, + { + "description": "[KOPILUWAK](https://attack.mitre.org/software/S1075) is a JavaScript-based reconnaissance tool that has been used for victim profiling and C2 since at least 2017.(Citation: Mandiant Suspected Turla Campaign February 2023)", + "meta": { + "external_id": "S1075", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1075", + "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity" + ], + "synonyms": [ + "KOPILUWAK" + ] + }, + "related": [ + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0f4a0c76-ab2d-4cb0-85d3-3f0efb8cba0d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c34f7aa-9341-4a48-bfab-af22e51aca6c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2e34237d-8574-43f6-aace-ae2915de8597", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "09fcc02f-f9d4-43fa-8609-5e5e186b7103", + "value": "KOPILUWAK - S1075" + }, { "description": "[SOUNDBITE](https://attack.mitre.org/software/S0157) is a signature backdoor used by [APT32](https://attack.mitre.org/groups/G0050). (Citation: FireEye APT32 May 2017)", "meta": { @@ -40812,6 +42644,195 @@ "uuid": "1da748a5-875d-4212-9222-b4c23ab861be", "value": "Prestige - S1058" }, + { + "description": "[Sardonic](https://attack.mitre.org/software/S1085) is a backdoor written in C and C++ that is known to be used by [FIN8](https://attack.mitre.org/groups/G0061), as early as August 2021 to target a financial institution in the United States. [Sardonic](https://attack.mitre.org/software/S1085) has a plugin system that can load specially made DLLs and execute their functions.(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)", + "meta": { + "external_id": "S1085", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1085", + "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor", + "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf" + ], + "synonyms": [ + "Sardonic" + ] + }, + "related": [ + { + "dest-uuid": "01a5a209-b94c-450b-b7f9-946497d91055", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "322bad5a-1c49-4d23-ab79-76d641794afa", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "799ace7f-e227-4411-baa0-8868704f2a69", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7c0f17c9-1af6-4628-9cbd-9e45482dd605", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "910906dd-8c0a-475a-9cc1-5e029e2fad58", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "970a3432-3237-47ad-bcca-7d8cbb217736", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b3d682b6-98f2-4fb0-aa3b-b4df007ca70a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d511a6f6-4a33-41d5-bc95-c343875d1377", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "0c52f5bc-557d-4083-bd27-66d7cdb794bb", + "value": "Sardonic - S1085" + }, { "description": "[SNUGRIDE](https://attack.mitre.org/software/S0159) is a backdoor that has been used by [menuPass](https://attack.mitre.org/groups/G0045) as first stage malware. (Citation: FireEye APT10 April 2017)", "meta": { @@ -41591,6 +43612,90 @@ "uuid": "72911fe3-f085-40f7-b4f2-f25a4221fe44", "value": "FoggyWeb - S0661" }, + { + "description": "[QUIETCANARY](https://attack.mitre.org/software/S1076) is a backdoor tool written in .NET that has been used since at least 2022 to gather and exfiltrate data from victim networks.(Citation: Mandiant Suspected Turla Campaign February 2023)", + "meta": { + "external_id": "S1076", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1076", + "https://www.mandiant.com/resources/blog/turla-galaxy-opportunity" + ], + "synonyms": [ + "QUIETCANARY", + "Tunnus" + ] + }, + "related": [ + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "707399d6-ab3e-4963-9315-d9d3818cd6a0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7dd95ff6-712e-4056-9626-312ea4ab4c5e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c32f7008-9fea-41f7-8366-5eb9b74bd896", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "93289ecf-4d15-4d6b-a9c3-4ab27e145ef4", + "value": "QUIETCANARY - S1076" + }, { "description": "[FluBot](https://attack.mitre.org/software/S1067) is a multi-purpose mobile banking malware that was first observed in Spain in late 2020. It primarily spread through European countries using a variety of SMS phishing messages in multiple languages.(Citation: proofpoint_flubot_0421)(Citation: bitdefender_flubot_0524)", "meta": { @@ -42109,7 +44214,7 @@ "refs": [ "https://attack.mitre.org/software/S1068", "https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/", - "https://www.cyber.gov.au/acsc/view-all-content/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat", + "https://www.cyber.gov.au/about-us/advisories/2022-004-acsc-ransomware-profile-alphv-aka-blackcat", "https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/" ], "synonyms": [ @@ -43078,6 +45183,159 @@ "uuid": "9752aef4-a1f3-4328-929f-b64eb0536090", "value": "RawPOS - S0169" }, + { + "description": "[Hornbill](https://attack.mitre.org/software/S1077) is one of two mobile malware families known to be used by the APT [Confucius](https://attack.mitre.org/groups/G0142). Analysis suggests that [Hornbill](https://attack.mitre.org/software/S1077) was first active in early 2018. While [Hornbill](https://attack.mitre.org/software/S1077) and [Sunbird](https://attack.mitre.org/software/S1082) overlap in core capabilities, [Hornbill](https://attack.mitre.org/software/S1077) has tools and behaviors suggesting more passive reconnaissance.(Citation: lookout_hornbill_sunbird_0221)", + "meta": { + "external_id": "S1077", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S1077", + "https://www.lookout.com/blog/lookout-discovers-novel-confucius-apt-android-spyware-linked-to-india-pakistan-conflict" + ], + "synonyms": [ + "Hornbill" + ] + }, + "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1d1b1558-c833-482e-aabb-d07ef6eae63d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2282a98b-5049-4f61-9381-55baca7c1add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24a77e53-0751-46fc-b207-99378fb35c08", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32063d7f-0a39-440d-a4a3-2694488f96cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "39dd7871-f59b-495f-a9a5-3cb8cc50c9b2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9c049d7b-c92a-4733-9381-27e2bd2ccadc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ab7400b7-3476-4776-9545-ef3fa373de63", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cf28ca46-1fd3-46b4-b1f6-ec0b72361848", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "15d78a95-af6a-4b06-8dae-76bedb0ec5a1", + "value": "Hornbill - S1077" + }, { "description": "[Daserf](https://attack.mitre.org/software/S0187) is a backdoor that has been used to spy on and steal from Japanese, South Korean, Russian, Singaporean, and Chinese victims. Researchers have identified versions written in both Visual C and Delphi. (Citation: Trend Micro Daserf Nov 2017) (Citation: Secureworks BRONZE BUTLER Oct 2017)", "meta": { @@ -43220,6 +45478,146 @@ "uuid": "b6b3dfc7-9a81-43ff-ac04-698bad48973a", "value": "Daserf - S0187" }, + { + "description": "[RotaJakiro](https://attack.mitre.org/software/S1078) is a 64-bit Linux backdoor used by [APT32](https://attack.mitre.org/groups/G0050). First seen in 2018, it uses a plugin architecture to extend capabilities. [RotaJakiro](https://attack.mitre.org/software/S1078) can determine it's permission level and execute according to access type (`root` or `user`).(Citation: RotaJakiro 2021 netlab360 analysis)(Citation: netlab360 rotajakiro vs oceanlotus)", + "meta": { + "external_id": "S1078", + "mitre_platforms": [ + "Linux" + ], + "refs": [ + "https://attack.mitre.org/software/S1078", + "https://blog.netlab.360.com/rotajakiro_linux_version_of_oceanlotus/", + "https://blog.netlab.360.com/stealth_rotajakiro_backdoor_en/" + ], + "synonyms": [ + "RotaJakiro" + ] + }, + "related": [ + { + "dest-uuid": "03259939-0b57-482f-8eb5-87c0e0d54334", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0a5231ec-41af-4a35-83d0-6bdf11f28c65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1c4e5d32-1fe9-4116-9d9d-59e3925bd6a2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "24bfaeba-cb0d-4525-b3dc-507c77ecec41", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "acd0ba37-7ba9-4cc5-ac61-796586cd856d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b18eae87-b469-4e14-b454-b171b416bc18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b63a34e8-0a61-4c97-a23b-bf8a2ed812e2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c21d5a77-d422-4a69-acd7-2c53c1faa34b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "dfefe2ed-4389-4318-8762-f0272b350a1b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e0232cb0-ded5-4c2e-9dc7-2893142a5c11", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "08e844a8-371f-4fe3-9d1f-e056e64a7fde", + "value": "RotaJakiro - S1078" + }, { "description": "[Truvasys](https://attack.mitre.org/software/S0178) is first-stage malware that has been used by [PROMETHIUM](https://attack.mitre.org/groups/G0056). It is a collection of modules written in the Delphi programming language. (Citation: Microsoft Win Defender Truvasys Sep 2017) (Citation: Microsoft NEODYMIUM Dec 2016) (Citation: Microsoft SIR Vol 21)", "meta": { @@ -43299,6 +45697,242 @@ "uuid": "c4de7d83-e875-4c88-8b5d-06c41e5b7e79", "value": "PUNCHTRACK - S0197" }, + { + "description": "[BOULDSPY](https://attack.mitre.org/software/S1079) is an Android malware, detected in early 2023, with surveillance and remote-control capabilities. Analysis of exfiltrated C2 data suggests that [BOULDSPY](https://attack.mitre.org/software/S1079) primarily targeted minority groups in Iran.(Citation: lookout_bouldspy_0423)", + "meta": { + "external_id": "S1079", + "mitre_platforms": [ + "Android" + ], + "refs": [ + "https://attack.mitre.org/software/S1079", + "https://www.lookout.com/blog/iranian-spyware-bouldspy" + ], + "synonyms": [ + "BOULDSPY" + ] + }, + "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "1d1b1558-c833-482e-aabb-d07ef6eae63d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "2282a98b-5049-4f61-9381-55baca7c1add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "32063d7f-0a39-440d-a4a3-2694488f96cc", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "46d818a5-67fa-4585-a7fc-ecf15376c8d5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6c49d50f-494d-4150-b774-a655022d20a6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "702055ac-4e54-4ae9-9527-e23a38e0b160", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "73c26732-6422-4081-8b63-6d0ae93d449e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "99e6295e-741b-4857-b6e5-64989eb039b4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b1c95426-2550-4621-8028-ceebf28b3a47", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c4b96c0b-cb58-497a-a1c2-bb447d79d692", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "c6421411-ae61-42bb-9098-73fddb315002", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d3bc5020-f6a2-41c0-8ccb-5e563101b60c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d446b9f0-06a9-4a8d-97ee-298cfee84f14", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d4536441-1bcc-49fa-80ae-a596ed3f7ffd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d8940e76-f9c1-4912-bea6-e21c251370b6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e1c912a9-e305-434b-9172-8a6ce3ec9c4a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e2ea7f6b-8d4f-49c3-819d-660530d12b77", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e3b936a4-6321-4172-9114-038a866362ec", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ec4c4baa-026f-43e8-8f56-58c36f3162dd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "a2ee7d2d-fb45-44f3-8f67-9921c7810db1", + "value": "BOULDSPY - S1079" + }, + { + "description": "[Disco](https://attack.mitre.org/software/S1088) is a custom implant that has been used by [MoustachedBouncer](https://attack.mitre.org/groups/G1019) since at least 2020 including in campaigns using targeted malicious content injection for initial access and command and control.(Citation: MoustachedBouncer ESET August 2023)", + "meta": { + "external_id": "S1088", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1088", + "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" + ], + "synonyms": [ + "Disco" + ] + }, + "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "43c9bc06-715b-42db-972f-52d25c09a20c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "e1445afd-c359-45ed-8f27-626dc4d5e157", + "value": "Disco - S1088" + }, { "description": "[Starloader](https://attack.mitre.org/software/S0188) is a loader component that has been observed loading [Felismus](https://attack.mitre.org/software/S0171) and associated tools. (Citation: Symantec Sowbug Nov 2017)", "meta": { @@ -43333,6 +45967,103 @@ "uuid": "96566860-9f11-4b6f-964d-1c924e4f24a4", "value": "Starloader - S0188" }, + { + "description": "[SharpDisco](https://attack.mitre.org/software/S1089) is a dropper developed in C# that has been used by [MoustachedBouncer](https://attack.mitre.org/groups/G1019) since at least 2020 to load malicious plugins.(Citation: MoustachedBouncer ESET August 2023)", + "meta": { + "external_id": "S1089", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1089", + "https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/" + ], + "synonyms": [ + "SharpDisco" + ] + }, + "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "348f1eef-964b-4eb6-bb53-69b3dcb0c643", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bc57495-ea59-4380-be31-a64af124ef18", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "92d7da27-2d91-488e-a00c-059dc162766d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "9a60a291-8960-4387-8a4a-2ab5c18bb50b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "1fefb062-feda-484a-8f10-0cebf65e20e3", + "value": "SharpDisco - S1089" + }, { "description": "[NETWIRE](https://attack.mitre.org/software/S0198) is a publicly available, multiplatform remote administration tool (RAT) that has been used by criminal and APT groups since at least 2012.(Citation: FireEye APT33 Sept 2017)(Citation: McAfee Netwire Mar 2015)(Citation: FireEye APT33 Webinar Sept 2017)", "meta": { @@ -44251,6 +46982,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -44349,6 +47087,13 @@ ], "type": "uses" }, + { + "dest-uuid": "dc01774a-d1c1-45fb-b506-0a5d1d6593d9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "e0b9ecb8-a7d1-43c7-aa30-8e19c6a92c86", "tags": [ @@ -44399,6 +47144,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "1d44f529-6fe6-489f-8a01-6261ac43f05e", "tags": [ @@ -45905,6 +48657,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -46031,6 +48790,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "e0232cb0-ded5-4c2e-9dc7-2893142a5c11", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "a5e91d50-24fa-44ec-9894-39a88f658cea", @@ -49192,7 +51958,7 @@ "refs": [ "https://attack.mitre.org/software/S0274", "https://securelist.com/calisto-trojan-for-macos/86543/", - "https://www.symantec.com/security-center/writeup/2018-073014-2512-99?om_rssid=sr-latestthreats30days" + "https://web.archive.org/web/20190111082249/https://www.symantec.com/security-center/writeup/2018-073014-2512-99?om_rssid=sr-latestthreats30days" ], "synonyms": [ "Calisto" @@ -52223,6 +54989,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "16d73b64-5681-4ea0-9af4-4ad86f7c96e8", "tags": [ @@ -58455,6 +61228,13 @@ ] }, "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "232b7f21-adf9-4b42-b936-b9d6f7df856e", "tags": [ @@ -58518,6 +61298,13 @@ ], "type": "uses" }, + { + "dest-uuid": "b97f1d35-4249-4486-a6b5-ee60ccf24fab", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "bf176076-b789-408e-8cba-7275e81c0ada", "tags": [ @@ -58538,6 +61325,13 @@ "estimative-language:likelihood-probability=\"almost-certain\"" ], "type": "uses" + }, + { + "dest-uuid": "e64c62cf-9cd7-4a14-94ec-cdaac43ab44b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" } ], "uuid": "f01e2711-4b48-4192-a2e8-5f56c945ca19", @@ -59331,6 +62125,13 @@ ], "type": "uses" }, + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -61400,6 +64201,27 @@ ], "type": "uses" }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "04fd5427-79c7-44ea-ae13-11b24778ff1c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0533ab23-3f7d-463f-9bd8-634d27e4dee1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "09c4c11e-4fa1-4f8c-8dad-3cf8e69ad119", "tags": [ @@ -61407,6 +64229,13 @@ ], "type": "uses" }, + { + "dest-uuid": "1608f3e1-598a-42f4-a01a-2e252e81728f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "1e9eb839-294b-48cc-b0d3-c45555a2a004", "tags": [ @@ -61449,6 +64278,41 @@ ], "type": "uses" }, + { + "dest-uuid": "3489cfc5-640f-4bb3-a103-9137b97de79f", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3ccef7ae-cb5e-48f6-8302-897105fbf55c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4933e63b-9b77-476e-ab29-761bc5b7d15a", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "494ab9f0-36e0-4b06-b10d-57285b040a06", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "4bc31b94-045b-4752-8920-aebaebdb6470", "tags": [ @@ -61484,6 +64348,13 @@ ], "type": "uses" }, + { + "dest-uuid": "7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "837f9164-50af-4ac0-8219-379d8a74cefc", "tags": [ @@ -61491,6 +64362,13 @@ ], "type": "uses" }, + { + "dest-uuid": "86850eff-2729-40c3-b85e-c4af26da4a2d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", "tags": [ @@ -61540,6 +64418,13 @@ ], "type": "uses" }, + { + "dest-uuid": "bf90d72c-c00b-45e3-b3aa-68560560d4c5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "d1fcf083-a721-4223-aedf-bf8960798d62", "tags": [ @@ -61561,6 +64446,13 @@ ], "type": "uses" }, + { + "dest-uuid": "df8b2a25-8bdf-4856-953c-a04372b1c161", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "dfd7cc1d-e1d8-4394-a198-97c4cab8aa67", "tags": [ @@ -63501,6 +66393,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -66241,6 +69140,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -66883,6 +69789,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "16d73b64-5681-4ea0-9af4-4ad86f7c96e8", "tags": [ @@ -69160,6 +72073,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -69468,6 +72388,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "198ce408-1470-45ee-b47f-7056050d4fc2", "tags": [ @@ -69782,6 +72709,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "16d73b64-5681-4ea0-9af4-4ad86f7c96e8", "tags": [ @@ -72256,6 +75190,13 @@ ] }, "related": [ + { + "dest-uuid": "114fed8b-7eed-4136-8b9c-411c5c7fff4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "6683aa0c-d98a-4f5b-ac57-ca7e9934a760", "tags": [ @@ -72745,6 +75686,13 @@ ], "type": "uses" }, + { + "dest-uuid": "4a2975db-414e-4c0c-bd92-775987514b4b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "4bed873f-0b7d-41d4-b93a-b6905d1f90b0", "tags": [ @@ -74943,5 +77891,5 @@ "value": "HermeticWizard - S0698" } ], - "version": 29 + "version": 30 } diff --git a/clusters/mitre-tool.json b/clusters/mitre-tool.json index 964aa97..28edd5f 100644 --- a/clusters/mitre-tool.json +++ b/clusters/mitre-tool.json @@ -2021,6 +2021,13 @@ ] }, "related": [ + { + "dest-uuid": "0c8ab3eb-df48-4b9c-ace7-beacaac81cc5", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "3c4a2599-71ee-4405-ba1e-0e28414b4bc5", "tags": [ @@ -2289,6 +2296,64 @@ "uuid": "2e45723a-31da-4a7e-aaa6-e01998a6788f", "value": "Tasklist - S0057" }, + { + "description": "[ngrok](https://attack.mitre.org/software/S0508) is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. [ngrok](https://attack.mitre.org/software/S0508) has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.(Citation: Zdnet Ngrok September 2018)(Citation: FireEye Maze May 2020)(Citation: Cyware Ngrok May 2019)(Citation: MalwareBytes LazyScripter Feb 2021)", + "meta": { + "external_id": "S0508", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S0508", + "https://cyware.com/news/cyber-attackers-leverage-tunneling-service-to-drop-lokibot-onto-victims-systems-6f610e44", + "https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html", + "https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf", + "https://www.zdnet.com/article/sly-malware-author-hides-cryptomining-botnet-behind-ever-shifting-proxy-service/" + ], + "synonyms": [ + "ngrok" + ] + }, + "related": [ + { + "dest-uuid": "118f61a5-eb3e-4fb6-931f-2096647f4ecd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "40597f16-0963-4249-bf4c-ac93b7fb9807", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "4fe28b27-b13c-453e-a386-c2ef362a573b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "731f4f55-b6d0-41d1-a7a9-072a66389aea", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "830c9528-df21-472c-8c14-a036bf17d665", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "2f7f03bb-f367-4a5a-ad9b-310a12a48906", + "value": "ngrok - S0508" + }, { "description": "[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June 2003)(Citation: Symantec Waterbug Jun 2019)(Citation: FireEye APT39 Jan 2019)", "meta": { @@ -2647,6 +2712,173 @@ "uuid": "c9cd7ec9-40b7-49db-80be-1399eddd9c52", "value": "Cachedump - S0119" }, + { + "description": "Pacu is an open-source AWS exploitation framework. The tool is written in Python and publicly available on GitHub.(Citation: GitHub Pacu)", + "meta": { + "external_id": "S1091", + "mitre_platforms": [ + "IaaS" + ], + "refs": [ + "https://attack.mitre.org/software/S1091", + "https://github.com/RhinoSecurityLabs/pacu" + ], + "synonyms": [ + "Pacu" + ] + }, + "related": [ + { + "dest-uuid": "16e94db9-b5b1-4cd0-b851-f38fbd0a70f2", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "30208d3e-0d6b-43c8-883e-44462a514619", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "435dfb86-2697-4867-85b5-2fef496c0517", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "55bb4471-ff1f-43b4-88c1-c9384ec47abf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "57a3d31a-d04f-4663-b2da-7df8ec3f8c9d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "77532a55-c283-4cd2-bc5d-2d0b65e9d88c", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7e150503-88e7-4861-866b-ff1ac82c4475", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8565825b-21c8-4518-b75e-cbc4c717a156", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "866d0d6d-02c6-42bd-aa2f-02907fdc0969", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8a2f40cf-8325-47f9-96e4-b1ca4c7389bd", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f104855-e5b7-4077-b1f5-bc3103b41abe", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "b6301b64-ef57-4cce-bb0b-77026f14a8db", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cacc40da-4c9e-462c-80d5-fd70a178b12d", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cba37adb-d6fb-4610-b069-dd04c0643384", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cfb525cc-5494-401d-a82b-2539ca46a561", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "d94b3ae9-8059-4989-8e9f-ea0f601f80a7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e24fcba8-2557-4442-a139-1ee2f2e784db", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e848506b-8484-4410-8017-3d235a52f5b3", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "ed2e45f9-d338-4eb2-8ce5-3a2e03323bc1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "f232fa7a-025c-4d43-abc7-318e81a73d65", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "1b3b8f96-43b1-4460-8e02-1f53d7802fb9", + "value": "Pacu - S1091" + }, { "description": "[Winexe](https://attack.mitre.org/software/S0191) is a lightweight, open source tool similar to [PsExec](https://attack.mitre.org/software/S0029) designed to allow system administrators to execute commands on remote servers. (Citation: Winexe Github Sept 2013) [Winexe](https://attack.mitre.org/software/S0191) is unique in that it is a GNU/Linux based client. (Citation: Überwachung APT28 Forfiles June 2015)", "meta": { @@ -3074,6 +3306,13 @@ ], "type": "uses" }, + { + "dest-uuid": "e0232cb0-ded5-4c2e-9dc7-2893142a5c11", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "e3a12395-188d-4051-9a16-ea8e14d07b88", "tags": [ @@ -3754,6 +3993,119 @@ "uuid": "d8d19e33-94fd-4aa3-b94a-08ee801a2153", "value": "SDelete - S0195" }, + { + "description": "[AsyncRAT](https://attack.mitre.org/software/S1087) is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.(Citation: Morphisec Snip3 May 2021)(Citation: Cisco Operation Layover September 2021)(Citation: Telefonica Snip3 December 2021)", + "meta": { + "external_id": "S1087", + "mitre_platforms": [ + "Windows" + ], + "refs": [ + "https://attack.mitre.org/software/S1087", + "https://blog.morphisec.com/revealing-the-snip3-crypter-a-highly-evasive-rat-loader", + "https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/", + "https://telefonicatech.com/blog/snip3-investigacion-malware" + ], + "synonyms": [ + "AsyncRAT" + ] + }, + "related": [ + { + "dest-uuid": "005a06c6-14bf-4118-afa0-ebcd8aebb0c9", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "0259baeb-9f63-4c69-bf10-eb038c390688", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "03d7999c-1f4c-42cc-8373-e7690d318104", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "09a60ea3-a8d1-4ae5-976e-5783248b72a4", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "29be378d-262d-4e99-b00d-852d573628e6", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "354a7f88-63fb-41b5-a801-ce3b377b36f1", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "391d824f-0ef1-47a0-b0ee-c59a75e27670", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "6faf650d-bf31-4eb4-802d-1000cf38efaf", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "7bd9c723-2f78-4309-82c5-47cad406572b", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "8f4a33ec-8b1f-4b80-a2f6-642b2e479580", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "cbb66055-0325-4111-aca0-40547b6ad5b0", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e4dc8c01-417f-458d-9ee0-bb0617c1b391", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, + { + "dest-uuid": "e6919abc-99f9-4c6c-95a5-14761e7b2add", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + } + ], + "uuid": "6a5947f3-1a36-4653-8734-526df3e1d28d", + "value": "AsyncRAT - S1087" + }, { "description": "[MimiPenguin](https://attack.mitre.org/software/S0179) is a credential dumper, similar to [Mimikatz](https://attack.mitre.org/software/S0002), designed specifically for Linux platforms. (Citation: MimiPenguin GitHub May 2017)", "meta": { @@ -6640,6 +6992,13 @@ ], "type": "uses" }, + { + "dest-uuid": "3298ce88-1628-43b1-87d9-0b5336b193d7", + "tags": [ + "estimative-language:likelihood-probability=\"almost-certain\"" + ], + "type": "uses" + }, { "dest-uuid": "54ca26f3-c172-4231-93e5-ccebcac2161f", "tags": [ @@ -6880,5 +7239,5 @@ "value": "Mythic - S0699" } ], - "version": 28 + "version": 29 }